WordPress Gallery for Google Photos < 1.2.1 Unauthenticated Google OAuth Token Disclosure (CVE-2026-15236)

Vulnerability Overview Vulnerability Name: Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure Description: The plugin fails to properly restrict access to third-party OAuth credentials for connected accounts, resulting in the leakage of persistent access and refresh tokens to unauthenticated users. This allows for long-term compromise of linked accounts. CVE: CVE-2026-15236 Classification: - Type: SENSITIVE DATA DISCLOSURE - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 7.5 (High) Affected Scope Affected Plugin: embed-google-photos Fixed Version: 1.2.1 Remediation Fixed Version: Upgrade to version 1.2.1 or later. Timeline Public Disclosure Date: 2026-07-23 Addition Date: 2026-07-23 Last Updated Date: 2026-07-23 Additional Information Original Researchers: Pablo González and Fran Ramírez Submitter: Pablo González and Fran Ramírez Verification Status: Yes WPVDB ID: bfec467b-0dfa-48c6-84c1-6ea38a7d4546 Related Vulnerabilities 2025-04-16: Essential Addons for Elementor < 6.1.10 - Contributor+ Information Disclosure 2026-06-08: Payment forms, Buy now buttons, and Invoicing System 2026-01-23: RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure 2025-09-22: WP System Information <= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure 2024-08-12: Bit Form Pro < 2.8.0 - Authenticated (Subscriber+) Sensitive Information Exposure POC Code POC Code: Will be demonstrated on 2026-08-23 to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Gallery for Google Photos < 1.2.1 Unauthenticated Google OAuth Token Disclosure (CVE-2026-15236)

More from this source