CVE-2026-15236 Overview
CVE-2026-15236 is an information disclosure vulnerability in the Gallery for Google Photos WordPress plugin before version 1.2.1. The plugin fails to restrict access to stored third-party OAuth credentials for the connected Google account. Unauthenticated remote attackers can retrieve the persistent access token and refresh token used to authorize the plugin against Google Photos. Because refresh tokens remain valid until explicitly revoked, an attacker who harvests these credentials retains long-term access to the linked Google account. The weakness is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can retrieve persistent OAuth access and refresh tokens, resulting in long-term compromise of the linked Google account.
Affected Products
- Gallery for Google Photos WordPress plugin versions prior to 1.2.1
- WordPress installations with the plugin enabled and a linked Google account
- Any Google account authorized through the vulnerable plugin instance
Discovery Timeline
- 2026-08-02 - CVE-2026-15236 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15236
Vulnerability Analysis
The Gallery for Google Photos plugin integrates WordPress sites with the Google Photos API using OAuth 2.0. During the authorization flow, the plugin receives an access token and a refresh token from Google and stores them locally for reuse when rendering galleries. In versions before 1.2.1, the storage location or retrieval endpoint used for these credentials is reachable without authentication. An unauthenticated attacker who queries the exposed resource retrieves the raw tokens.
Access tokens grant immediate API access to the connected Google Photos library. Refresh tokens are more damaging because they can be exchanged for new access tokens indefinitely, until the user revokes the plugin's OAuth grant in their Google account settings. An attacker who obtains a refresh token maintains persistent access even after the plugin is patched or removed, unless the victim revokes the grant.
Root Cause
The plugin does not enforce authentication or authorization checks on the storage or retrieval path for OAuth credentials. Sensitive material intended for server-side use only becomes reachable by unauthenticated HTTP requests. This is a classic broken access control pattern combined with sensitive data exposure [CWE-200].
Attack Vector
Exploitation requires only network access to the vulnerable WordPress site. The attacker sends an unauthenticated HTTP request to the exposed resource and reads the returned OAuth tokens. No user interaction, privileges, or exploitation chain is needed. The attacker then presents the refresh token to Google's OAuth token endpoint to mint fresh access tokens and reach the victim's Google Photos data.
Refer to the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-15236
Indicators of Compromise
- Unauthenticated HTTP requests to plugin paths under /wp-content/plugins/ associated with Gallery for Google Photos
- Outbound OAuth token exchange requests to oauth2.googleapis.com originating from unexpected client IPs
- Google account security notifications referencing new API activity from unfamiliar locations
- Access log entries showing repeated GETs against plugin storage or configuration endpoints from a single external IP
Detection Strategies
- Audit WordPress access logs for anonymous requests to Gallery for Google Photos plugin resources returning non-empty payloads
- Correlate WordPress request logs with Google Workspace or personal account audit logs to identify token replay from new IP addresses
- Deploy web application firewall rules that block direct access to plugin data files and OAuth credential stores
Monitoring Recommendations
- Enable Google account activity alerts and review the list of authorized third-party applications regularly
- Monitor outbound network traffic from the WordPress host for anomalous connections to Google API endpoints
- Alert on installations of the Gallery for Google Photos plugin at versions below 1.2.1 across managed WordPress fleets
How to Mitigate CVE-2026-15236
Immediate Actions Required
- Update the Gallery for Google Photos plugin to version 1.2.1 or later on all WordPress instances
- Revoke the plugin's OAuth grant in the linked Google account at myaccount.google.com/permissions to invalidate any exposed refresh tokens
- Reconnect the plugin after patching to generate fresh tokens under the fixed access controls
- Review WordPress and Google account audit logs for evidence of token abuse prior to remediation
Patch Information
The vendor addressed the vulnerability in Gallery for Google Photos version 1.2.1. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Deactivate and remove the Gallery for Google Photos plugin until the patched version can be deployed
- Block unauthenticated access to plugin directories at the web server or WAF layer
- Restrict the OAuth scope granted to the plugin to the minimum required for gallery rendering
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
