CVE-2024-32949: Integrate Google Drive Auth Bypass Flaw

CVE-2024-32949 Overview

CVE-2024-32949 is a Missing Authorization vulnerability [CWE-862] in the Prince Integrate Google Drive plugin for WordPress. The flaw stems from incorrectly configured access control security levels in the plugin. Affected versions span from initial release through 1.3.8. An unauthenticated attacker can reach plugin functionality that should be restricted to privileged users. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction.

Critical Impact
Unauthenticated network attackers can interact with restricted plugin endpoints, leading to unauthorized read, modification, and limited service disruption involving Google Drive integration data on the affected WordPress site.

Affected Products

Prince Integrate Google Drive plugin for WordPress
All versions up to and including 1.3.8
WordPress sites with the plugin installed and activated

Discovery Timeline

2026-06-17 - CVE-2024-32949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32949

Vulnerability Analysis

The Integrate Google Drive plugin exposes Asynchronous JavaScript and XML (AJAX) actions and REST routes that lack proper capability checks. The plugin registers handlers without verifying whether the calling user has the appropriate role or nonce. As a result, requests from unauthenticated or low-privileged users reach functionality intended for administrators.

This class of weakness is tracked as [CWE-862] Missing Authorization. The scope is marked as changed in the advisory, indicating that successful exploitation affects resources beyond the vulnerable component. Confidentiality, integrity, and availability are each impacted at a low level, consistent with limited but real exposure of file metadata, configuration, or integration state.

The EPSS probability is 0.293% with a percentile of 20.798, indicating low observed exploitation activity at publication. No public proof-of-concept or in-the-wild exploitation has been confirmed by the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities (CISA KEV) catalog.

Root Cause

The root cause is the absence of current_user_can() or equivalent capability checks on plugin endpoints. Handlers process incoming requests without verifying the caller's role or validating a WordPress nonce tied to a privileged context. Authorization logic is either missing or applied at the wrong security level.

Attack Vector

An attacker sends crafted HTTP requests to the plugin's AJAX or REST endpoints over the network. No authentication is required, and no user interaction is needed. The attacker invokes plugin actions associated with the Google Drive integration directly. Refer to the Patchstack Vulnerability Advisory for endpoint-level technical details.

Detection Methods for CVE-2024-32949

Indicators of Compromise

Unexpected HTTP POST requests to /wp-admin/admin-ajax.php with action parameters tied to the Integrate Google Drive plugin from unauthenticated sessions.
Requests to plugin REST routes under /wp-json/ referencing Integrate Google Drive without a valid X-WP-Nonce header.
New or modified Google Drive integration settings in the WordPress options table without a corresponding administrator login event.

Detection Strategies

Review WordPress access logs for anonymous requests targeting plugin AJAX actions and REST routes.
Correlate plugin configuration changes with authenticated administrator sessions to surface unauthorized modifications.
Enable a Web Application Firewall (WAF) ruleset that flags unauthenticated calls to plugin-specific endpoints.

Monitoring Recommendations

Alert on spikes of admin-ajax.php traffic from a single source IP without prior authentication cookies.
Monitor outbound traffic from the WordPress host to Google Drive API endpoints for anomalous patterns.
Audit the wp_options table for unscheduled changes to Integrate Google Drive configuration keys.

How to Mitigate CVE-2024-32949

Immediate Actions Required

Update the Integrate Google Drive plugin to a version later than 1.3.8 as soon as the vendor publishes a fixed release.
Deactivate and remove the plugin if it is not in active use on the WordPress site.
Rotate any Google Drive API credentials or OAuth tokens stored by the plugin.

Patch Information

The vendor advisory tracked by Patchstack identifies versions through 1.3.8 as vulnerable. Administrators should consult the Patchstack Vulnerability Advisory and the official WordPress plugin repository for the current fixed version and upgrade instructions.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and /wp-json/ at the WAF or reverse proxy when unauthenticated calls to plugin actions are detected.
Apply IP allowlisting to the WordPress administrative interface to reduce the attack surface.
Disable the plugin until a patched version is deployed if Google Drive integration is non-critical.

bash

# Example: disable the plugin via WP-CLI until a fixed version is available
wp plugin deactivate integrate-google-drive
wp plugin status integrate-google-drive