CVE-2026-15236 — Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the…
Published: 2026-08-02 · CVSS: 7.5 · CVSS 3.1
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7