GO SMS Pro, with over 100 million installs, has been found to have an unpatched flaw that publicly exposes media transferred between users, including private voice messages, photos, and videos.