Integrate Google Drive CVE-2023-32117

Exploitation requires only that the target WordPress site has the Integrate Google Drive plugin installed and activated at version 1.1.99 or earlier, and that the vulnerable handler endpoint (admin-ajax.php action or plugin REST route) is reachable from the attacker's network - which is the default for any internet-facing WordPress site. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special site configuration are needed. The primary limiting factor is the plugin's installed base: only sites that have actively installed integrate-google-drive are vulnerable, and the practical impact depends on whether the site has actually connected a Google Drive account (an unconnected install limits data exposure, though authorization-bypass write operations may still be possible).

Signals converge toward high real-world risk: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivially reachable remote unauthenticated exploitation with C:H/I:H/A:H impact, and the EPSS score of 88.16% at the 99th percentile is one of the strongest predictive indicators of near-term exploitation. The vulnerability was reported through Patchstack, which monitors WordPress plugin abuse closely. However, the CVE is not currently on CISA KEV and no public exploit is identified at the time of analysis, so 'high probability of exploitation' is not the same as confirmed active exploitation - the gap between EPSS expectation and KEV confirmation suggests this should be treated as imminent rather than ongoing. The 'C:H/I:H/A:H' rating in a plugin context typically reflects worst-case scenarios (admin takeover or arbitrary file access via Drive integration), which should be verified against the specific endpoint behavior since plugin CVSS scores are sometimes inflated.

An attacker scans WordPress sites for the integrate-google-drive plugin (commonly fingerprinted via /wp-content/plugins/integrate-google-drive/ asset paths), then sends an unauthenticated HTTP request to the plugin's vulnerable AJAX or REST endpoint to invoke a privileged action - for example, file listing, upload, deletion, or settings modification against the connected Drive account. Because no authentication, user interaction, or non-default configuration is required, this can be fully automated at scale across all sites running vulnerable versions. No public exploit identified at time of analysis, but the 99th percentile EPSS score indicates exploit code is highly likely to surface or already exists in private toolkits.