WordPress Plugin Vulnerabilities

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

Description

The plugin does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

Proof of Concept

Affects Plugins

Plugin icon
embed-google-photos
Fixed in 1.2.1

References

CVE
CVE-2026-15236

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Pablo González and Fran Ramírez
Submitter
Pablo González and Fran Ramírez
Verified
Yes
WPVDB ID
bfec461b-0dfa-48c6-84c1-6ea38a7d4546

Timeline

Publicly Published
2026-07-23 (about 11 days ago)
Added
2026-07-23 (about 10 days ago)
Last Updated
2026-07-23 (about 10 days ago)

Other

Published
Title
Published
2025-05-30
Title
WooCommerce Orders & Customers Exporter <= 5.0 - Authenticated (Subscriber+) Information Exposure
Published
2025-04-15
Title
Hive Support < 1.2.7 - Unauthenticated Sensitive Information Exposure
Published
2025-07-16
Title
JetEngine < 3.7.1.1 - Authenticated (Subscriber+) Information Exposure
Published
2026-03-30
Title
Gravity SMTP < 2.1.5 - Unauthenticated Sensitive Information Exposure via REST API
Published
2025-01-06
Title
Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure