Description
WordPress Plugin Google Drive for WordPress is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin Google Drive for WordPress version 2.2 is vulnerable; prior versions may also be affected.
Remediation
Disable the plugin until a fix is available
References
https://lenonleite.com.br/en/publish-exploits/plugin-google-drive-for-wordpress-2-2-rce-unlik/
https://www.youtube.com/watch?v=_536kM2-TZI
https://www.exploit-db.com/exploits/44435/
https://packetstormsecurity.com/files/147132/WordPress-Google-Drive-2.2-Remote-Code-Execution.html
Related Vulnerabilities
WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.14)
MySQL CVE-2020-2926 Vulnerability (CVE-2020-2926)
Undertow CVE-2022-2764 Vulnerability (CVE-2022-2764)
WordPress Plugin Constant Contact for WordPress Unspecified Vulnerability (3.1.6)
WordPress Plugin Rencontre-Dating Site Security Bypass (1.6.9)