A flaw in the Integrate Google Drive plugin for WordPress permits an attacker to bypass authorization checks and gain access to Google Drive data linked to the site. The vulnerability stems from improperly enforced access control logic, enabling users or potentially unauthenticated actors to request sensitive information. The weakness is a classic Broken Access Control scenario (CWE‑862).

The affected component is the Integrate Google Drive WordPress plugin, developed by princeahmed. Versions from the earliest release through version 1.5.6, inclusive, are vulnerable. Any WordPress site using these versions could be impacted.

The CVSS base score of 5.4 indicates moderate risk, while the EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be through normal usage of the plugin, potentially exploiting misconfigured user roles or permissions within the WordPress ecosystem. There is no evidence of a publicly exploitable remote code execution path, but unauthorized data retrieval is feasible if an attacker can trigger the plugin’s API calls. The risk is therefore concentrated on privileged or compromised users who can manipulate the plugin’s settings.