The vulnerability allows anyone to retrieve stored third‑party OAuth credentials for the connected account without authentication, exposing persistent access and refresh tokens. These tokens enable an attacker to impersonate the account indefinitely, granting unauthorized access to Google APIs and possibly the user’s private data.

This flaw affects the WordPress plugin Gallery for Google Photos versions prior to 1.2.1. That includes all installations of the plugin before the 1.2.1 release that rely on Google OAuth for photo access.

An attacker can exploit this flaw by simply accessing the plugin’s configuration endpoint, which does not enforce authentication. Because the EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation at present is low, yet the impact of token compromise is severe. The vulnerability is unpatched in any version before 1.2.1, so upgrading promptly is essential. The CVSS score is 7.5, indicating a medium‑high severity.