Vulnerabilities / Mixed Media Gallery Blocks / WPSEC-2026-0277
Mixed Media Gallery Blocks <= 3.4.2 - Unauthenticated Sensitive Information Exposure via Gallery Block Video API Access Token
Medium 5.3
CWE-200Fixed in 3.4.3
- ID
- WPSEC-2026-0277
- Plugin
- SimpLy Gallery (simply-gallery-block)
- Affected
- all versions before 3.4.3
- Remediation
- Update to 3.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Mixed Media Gallery Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Mixed Media Gallery Blocks (SimpLy Gallery) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.2. When a gallery is built from a Vimeo collection (a PLUS/PRO feature), the site's Vimeo personal access token is stored in the block's galleryVMQuery attribute, and the gallery block render callback prints that attribute unmasked into the page markup. This makes it possible for unauthenticated attackers to extract the site's Vimeo access token from any page that displays such a gallery.
References
- https://wpsec.com/vuln/WPSEC-2026-0277/
- https://plugins.svn.wordpress.org/simply-gallery-block/tags/3.4.3/
- https://wordpress.org/plugins/simply-gallery-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS