What is the CVSS score of CVE-2026-15236?

CVE-2026-15236 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gallery for Google Photos are affected by CVE-2026-15236?

The Gallery for Google Photos WordPress plugin (versions before 1.2.1) contains an unauthenticated vulnerability allowing attackers to retrieve stored Google OAuth credentials without authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-15236?

Yes, a public proof-of-concept exploit is available for CVE-2026-15236. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-15236?

Within 24 hours, identify all WordPress installations using Gallery for Google Photos and update to version 1.2.1 immediately. Within 7 days, audit the Google account activity logs (via google.com/myaccount/security-checkup) for the connected account to identify unauthorized access attempts or suspicious sign-in activity during the vulnerability window; change the Google account password and enable 2-factor authentication if not already active. Within 30 days, implement a systematic WordPress plugin security monitoring process with patches deployed within 48 hours of vendor release, and conduct a full plugin audit for similar credential exposure vulnerabilities.

Gallery for Google Photos CVE-2026-15236

EUVD-2026-51953 HIGH

Information Exposure (CWE-200)

2026-08-02 WPScan

GHSA-465m-pvh5-8rh9

WordPress Information Disclosure Google Gallery For Google Photos Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint exposes high-value OAuth secrets; no integrity or availability impact applies to the WordPress system itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:23 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

7.5 (HIGH)

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

AnalysisAI

Unauthenticated exposure of OAuth credentials in the Gallery for Google Photos WordPress plugin (all versions before 1.2.1) allows any remote attacker to retrieve the stored Google access and refresh tokens of the connected account without authentication. Because refresh tokens are long-lived and self-renewing, a successful retrieval grants persistent, long-term access to the linked Google account well beyond any single session. A publicly available exploit exists per WPScan, though EPSS remains low (0.16%, 6th percentile), suggesting exploitation is not yet widespread.

Technical ContextAI

The plugin integrates WordPress sites with Google Photos via OAuth 2.0, storing both short-lived access tokens and long-lived refresh tokens server-side as part of the connected-account credentials. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: the plugin fails to enforce access controls on the storage location or retrieval endpoint for these credentials, making them readable by unauthenticated HTTP clients. The danger is amplified by OAuth's design - refresh tokens are persistent secrets that can generate new access tokens indefinitely, meaning exfiltration is equivalent to a long-term account takeover rather than a momentary credential leak. Affected product per CPE: cpe:2.3:a:unknown:gallery_for_google_photos:*:*:*:*:*:*:*:* covering all versions up to 1.2.1.

RemediationAI

Update the Gallery for Google Photos WordPress plugin to version 1.2.1 immediately, as this is the vendor-confirmed patched release. After updating, site administrators should revoke and rotate the connected Google OAuth credentials via the Google account security settings (https://myaccount.google.com/permissions) to invalidate any tokens that may have already been exposed, since updating the plugin alone does not invalidate previously leaked tokens. If immediate patching is not possible, a compensating control is to deactivate the plugin entirely, which removes the credential exposure surface at the cost of disabling the gallery functionality. Additionally, review Google account access logs for unexpected third-party application activity. The WPScan advisory at https://wpscan.com/vulnerability/bfec461b-0dfa-48c6-84c1-6ea38a7d4546/ contains further details.