ByteOS Network

CVE Vulnerability Details :

CVE-2026-15236

PUBLISHED

More Info Official Page

Assigner-WPScan

Assigner Org ID-1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81

Published At-02 Aug, 2026 | 06:00

Updated At-02 Aug, 2026 | 06:00

▼CVE Numbering Authority (CNA)

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

Affected Products

Vendor

Unknown

Product

Gallery for Google Photos

Default Status

unaffected

Versions

Affected

From 0 before 1.2.1 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-200	CWE-200 Information Exposure

Type: CWE

CWE ID: CWE-200

Description: CWE-200 Information Exposure

Credits

finder

Pablo González and Fran Ramírez

coordinator

WPScan

References

Hyperlink	Resource
https://wpscan.com/vulnerability/bfec461b-0dfa-48c6-84c1-6ea38a7d4546/	exploit vdb-entry technical-description

Hyperlink: https://wpscan.com/vulnerability/bfec461b-0dfa-48c6-84c1-6ea38a7d4546/

Resource:

exploit

vdb-entry

technical-description

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References