Active Exploitation of Gravity SMTP Plugin Flaw (CVE-2026-4020) Exposes Sensitive Data on 100,000 WordPress Sites

Executive Summary

A medium-severity information disclosure vulnerability in the Gravity SMTP plugin for WordPress, tracked as CVE-2026-4020, is under active and widespread exploitation. The flaw, affecting an estimated 100,000 websites, allows an unauthenticated attacker to retrieve a detailed system report containing sensitive credentials and configuration data. The vulnerability stems from an insecure REST API endpoint that fails to perform any authentication or authorization checks. Attackers are using this flaw to steal API keys and OAuth tokens for third-party email services. Security firm Defiant has reported blocking millions of exploit attempts, confirming that attackers are using automated scanners to find and compromise vulnerable sites. Users are urged to update to the patched version (2.1.5) immediately and rotate any credentials managed by the plugin.

Vulnerability Details

CVE-2026-4020 is an unauthenticated information disclosure vulnerability with a CVSS score of 5.3.

• Attack Vector: The vulnerability is exploited by sending a simple HTTP GET request to a specific REST API endpoint exposed by the plugin.
• Root Cause: The endpoint, located at /wp-json/gravitysmtp/v1/tests/mock-data, was configured with a permission callback that always returned true. This means that any request, regardless of authentication status, was granted access.
• Mechanism: An unauthenticated attacker can make a request to https://<vulnerable-site>/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings. The plugin responds with a large JSON file containing the site's full system report. This report was likely intended for debugging purposes but was left publicly exposed.

Affected Systems

• Gravity SMTP plugin for WordPress, versions 2.1.4 and below.
• The vulnerability was patched in version 2.1.5, released on March 17, 2026.
• An estimated 100,000 websites have the plugin installed.

Exploitation Status

The vulnerability is being actively and widely exploited. WordPress security firm Defiant, makers of the Wordfence firewall, reported blocking over 17 million exploitation attempts targeting this flaw. This indicates that threat actors have integrated the exploit into automated scanning tools and are indiscriminately targeting any site running a vulnerable version of the plugin.

Impact Assessment

A successful exploit of this vulnerability provides an attacker with a wealth of sensitive information that can be used for further attacks:

• Credential Theft: The most critical impact is the exposure of API keys, secrets, and OAuth tokens for email services (e.g., SendGrid, Mailgun) configured in the plugin. Attackers can use these credentials to send spam or phishing emails from the compromised domain, abusing its reputation (T1586.002 - Email Accounts).
• Reconnaissance: The system report contains detailed information about the target environment, including the server's operating system, PHP version, database version, and a full list of all other active plugins and their versions. This information is a goldmine for an attacker, allowing them to identify other potential vulnerabilities to exploit for a more severe compromise (T1592 - Gather Victim Host Information).

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• WAF/Firewall Logs: The easiest way to detect exploitation attempts is to search your Web Application Firewall (WAF) or web server access logs for GET requests to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint. Any such request should be treated as an indicator of targeting.
• Vulnerability Scanning: Use a WordPress-aware vulnerability scanner to check if your site is running a vulnerable version of the Gravity SMTP plugin.

Remediation Steps

1. Update Immediately: The most critical step is to update the Gravity SMTP plugin to version 2.1.5 or later. This action, a form of M1051 - Update Software, completely removes the vulnerability.
2. Assume Compromise and Rotate Credentials: If you were running a vulnerable version, you must assume that all credentials stored within the plugin have been compromised. Immediately log into your third-party email service providers (e.g., SendGrid, Postmark, Mailgun) and rotate/regenerate all API keys and OAuth tokens. Update the Gravity SMTP plugin with the new credentials.
3. Review Logs: While not strictly necessary if credentials have been rotated, you can review the logs of your email service provider for any unusual sending activity since the plugin was installed.