Critical severity · published Mar 30, 2024
CVE-2024-2086
Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers to modify plugin settings as well as allowing full read/write/delete access to the Google Drive associated with the plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
File Manager for Google Drive – Integrate Google Drive · princeahmed
through 1.3.8 · source: vendor
Affected product
FM
File Manager for Google Drive – Integrate Google Drive
princeahmed
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2086
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3051452/integrate-google-drive/tags/1.3.9/includes/class-ajax.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a303c798-c206-426a-9a96-263c8c069bdb?source=cve
More from File Manager for Google Drive – Integrate Google Drive
7.5
CVE-2025-12139
File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure
6.1
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter