Gallery For Google Photos
Monthly
Unauthenticated exposure of OAuth credentials in the Gallery for Google Photos WordPress plugin (all versions before 1.2.1) allows any remote attacker to retrieve the stored Google access and refresh tokens of the connected account without authentication. Because refresh tokens are long-lived and self-renewing, a successful retrieval grants persistent, long-term access to the linked Google account well beyond any single session. A publicly available exploit exists per WPScan, though EPSS remains low (0.16%, 6th percentile), suggesting exploitation is not yet widespread.
Unauthenticated exposure of OAuth credentials in the Gallery for Google Photos WordPress plugin (all versions before 1.2.1) allows any remote attacker to retrieve the stored Google access and refresh tokens of the connected account without authentication. Because refresh tokens are long-lived and self-renewing, a successful retrieval grants persistent, long-term access to the linked Google account well beyond any single session. A publicly available exploit exists per WPScan, though EPSS remains low (0.16%, 6th percentile), suggesting exploitation is not yet widespread.