Cross‑Site Request Forgery (CSRF) in the WordPress plugin Integrate Google Drive allows an attacker to force a logged‑in user to send forged requests. The flaw exists in all releases up to version 1.5.2. This can result in the execution of actions on behalf of the user that the attacker has not explicitly authorized, potentially compromising the integrity of the site’s data and operations performed through the plugin.

The vulnerability affects the WordPress plugin Integrate Google Drive by princeahmed, with all releases up to and including version 1.5.2 susceptible to CSRF exploitation. Any environment running a vulnerable instance of this plugin is at risk.

The CVSS score of 4.3 marks the issue as moderate, while the EPSS score of less than 1% indicates a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a malicious webpage that forces a logged‑in user’s browser to submit a forged request to the plugin; this is typical of CSRF attacks and requires compromised user credentials and browser interaction.