The File Manager for Google Drive – Integrate Google Drive WordPress plugin versions up to 1.5.3 contain a CWE-200 information exposure vulnerability in the "get_localize_data" function. This vulnerability allows unauthenticated attackers to retrieve sensitive data including Google OAuth client credentials and account email addresses. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The impact is limited to confidentiality, with no integrity or availability impact reported. The CVSS 3.1 base score is 7.5 (High). No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on the plugin vendor releasing an update.

An unauthenticated attacker can extract sensitive Google OAuth credentials (client_id and client_secret) and Google account email addresses from the vulnerable plugin. This exposure can lead to unauthorized access to Google API resources associated with these credentials, potentially compromising user data confidentiality. There is no reported impact on data integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exposure of sensitive credentials. Monitor for vendor updates and apply patches promptly once available.