CVE-2026-15236: Unknown Gallery For Google Photos

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

Affected products

• Unknown Gallery For Google Photos: before 1.2.1 (fixed in 1.2.1)

Published 2026-08-02. Last modified 2026-08-26.