CVE-2025-12139: WordPress Google Drive Info Disclosure

CVE-2025-12139 Overview

The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress contains a sensitive information exposure vulnerability in all versions up to and including 1.5.3. The vulnerability exists within the get_localize_data function, which improperly exposes sensitive configuration data to unauthenticated users. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.

Critical Impact

Unauthenticated attackers can steal Google OAuth credentials and email addresses, potentially enabling account takeover, unauthorized Google Drive access, and broader compromise of connected Google services.

Affected Products

• File Manager for Google Drive – Integrate Google Drive with WordPress plugin versions up to and including 1.5.3
• WordPress installations using the vulnerable plugin

Discovery Timeline

• 2025-11-05 - CVE-2025-12139 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2025-12139

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in the plugin's class-enqueue.php file, specifically within the get_localize_data function. This function is responsible for passing configuration data to JavaScript on the frontend, but it fails to implement proper access controls, resulting in sensitive OAuth credentials being exposed to any user who can access the page.

The exposed data includes Google OAuth client_id and client_secret values, which are critical authentication credentials that should never be accessible to unauthenticated users. Additionally, Google account email addresses linked to the integration are also leaked, providing attackers with valuable information for targeted attacks.

Root Cause

The root cause is improper information exposure in the localization data handling mechanism. The get_localize_data function in class-enqueue.php includes sensitive Google API credentials in the data passed to the frontend without verifying whether the requesting user has appropriate permissions. This architectural flaw means that any visitor to a page where the plugin is loaded can potentially access these credentials through the localized JavaScript data.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by simply visiting a WordPress site that uses the vulnerable plugin and inspecting the page source or JavaScript variables to extract the exposed OAuth credentials.

The attack flow involves:

1. Attacker identifies a WordPress site using the vulnerable File Manager for Google Drive plugin
2. Attacker accesses any page where the plugin loads its scripts
3. The get_localize_data function exposes sensitive data in the page's JavaScript context
4. Attacker extracts client_id, client_secret, and associated email addresses
5. Attacker can use these credentials to impersonate the legitimate OAuth application or access Google services

For technical details on the vulnerable code, see the WordPress Plugin Class Source.

Detection Methods for CVE-2025-12139

Indicators of Compromise

• Unusual access patterns to WordPress pages where the Google Drive integration is active
• Evidence of automated scraping or enumeration of localized JavaScript data
• Unauthorized use of Google OAuth credentials associated with WordPress integrations
• Suspicious authentication attempts to Google APIs using compromised credentials

Detection Strategies

• Monitor web server logs for unusual access patterns targeting pages with the Google Drive plugin
• Implement content security policies and monitor for credential exposure in client-side JavaScript
• Review Google Cloud Platform audit logs for unexpected OAuth activity using the exposed credentials
• Use web application firewalls to detect and block automated credential harvesting attempts

Monitoring Recommendations

• Enable detailed logging for Google OAuth authentication events in Google Cloud Console
• Configure alerts for new OAuth token generation or unusual API access patterns
• Monitor WordPress plugin update status to ensure timely patching
• Implement endpoint detection to identify exploitation attempts against WordPress installations

How to Mitigate CVE-2025-12139

Immediate Actions Required

• Update the File Manager for Google Drive plugin to a patched version immediately
• Rotate all Google OAuth credentials (client_id and client_secret) that may have been exposed
• Review Google Cloud Platform access logs for any unauthorized activity
• Consider temporarily deactivating the plugin until the update can be applied

Patch Information

A security patch is available via WordPress Changeset #3387825. Site administrators should update the plugin through the WordPress admin dashboard or by manually downloading and installing the latest version from the WordPress plugin repository.

For additional vulnerability details and tracking, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Temporarily disable the File Manager for Google Drive plugin until a patched version can be installed
• Restrict access to the WordPress site using IP whitelisting or authentication if the plugin cannot be immediately updated
• Use a web application firewall to filter requests and prevent exposure of localized data
• Remove stored Google OAuth credentials from the plugin settings and reconfigure after patching

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate integrate-google-drive

# Update to the latest patched version
wp plugin update integrate-google-drive

# Verify the installed version
wp plugin get integrate-google-drive --field=version