Gravity SMTP CVE-2026-4020: WordPress Plugin Actively Exploited

Threat actors are actively exploiting CVE-2026-4020, an unauthenticated information disclosure vulnerability in the popular Gravity SMTP WordPress plugin. This flaw exposes sensitive credentials and system configuration data on over 100,000 websites. Website administrators must patch immediately to prevent email service compromise and further site intrusion.

What Happened: Gravity SMTP Plugin Under Active Attack

On June 19, 2026, Wordfence confirmed that attackers are exploiting CVE-2026-4020 in the wild. The vulnerability affects all versions of Gravity SMTP up to and including 2.1.4. Consequently, any unpatched site running this plugin is at risk of credential theft and reconnaissance.

The issue stems from an improperly secured REST API endpoint within the plugin. Specifically, the endpoint’s permission callback always returns true. Therefore, unauthenticated attackers can retrieve a comprehensive “System Report” JSON containing API keys, OAuth tokens, email service credentials, and detailed server configuration data.

Wordfence’s firewall has already blocked more than 17 million exploit attempts against protected customers. Moreover, exploitation volume spiked dramatically on June 7, 2026, with over 4 million requests logged in a single day. This indicates a large-scale, automated campaign targeting vulnerable WordPress installations globally.

Technical Details of the CVE-2026-4020 Vulnerability

The root cause lies in the plugin’s REST API route registration. Gravity SMTP registers a test endpoint at /wp-json/gravitysmtp/v1/tests/mock-data for internal diagnostics. However, the associated permission_callback unconditionally returns true, bypassing all authentication checks.

When an unauthenticated GET request hits this endpoint with the ?page=gravitysmtp-settings query parameter, the plugin returns its full System Report. This report contains highly sensitive data that should never be exposed to anonymous users.

Exposed Data in the System Report

• API keys, secrets, and OAuth tokens for configured email integrations
• Credentials for third-party email services including Amazon SES, Google, Mailjet, Resend, and Zoho
• WordPress configuration details such as installed plugins, themes, and software versions
• Server and PHP environment information revealing the hosting stack
• Database configuration details including server version and table names

Although the vulnerability carries a medium CVSS severity rating, the real-world impact is severe. An attacker needs no credentials, no user interaction, and no special tools. A simple HTTP GET request is sufficient to harvest secrets from the target site.

Attack Prerequisites

• The target site must have Gravity SMTP version 2.1.4 or older installed and active
• The WordPress REST API must be accessible (default configuration)
• No additional authentication or network segmentation is required for exploitation

Business and Operational Impact

The exposure of live third-party API credentials creates immediate operational risk. Attackers can abuse the victim’s connected email services to send phishing campaigns, spam, or malicious attachments. Furthermore, the detailed system report significantly lowers the effort required to plan follow-on attacks against the site.

Wordfence researchers warn that the stolen information enables several downstream threats. For example, an attacker who harvests an Amazon SES key can send thousands of emails from the victim’s account. This damages sender reputation, triggers service suspension, and may expose the organization to compliance violations.

Key Impact Categories

• Email service abuse: Attackers can impersonate the organization using compromised SMTP and API credentials
• Reconnaissance acceleration: Detailed plugin and version lists enable targeted exploitation of other known vulnerabilities
• Credential cascading: OAuth tokens for integrated services may grant access to CRM, marketing, and customer data platforms
• Compliance exposure: Data breaches involving customer records may trigger GDPR, CCPA, and industry-specific notification requirements
• Reputational damage: Compromised email domains suffer blacklisting and loss of customer trust

Mitigation and Recommendations

Defenders should act immediately to reduce exposure. The patch has been available since March 17, 2026, yet many sites remain vulnerable. Delayed patching is the primary risk factor in this campaign.

Immediate Actions for Website Administrators

1. Upgrade Gravity SMTP to version 2.1.5 or later immediately. The vendor patched the vulnerable REST API endpoint in this release.
2. Review web server access logs for exploit indicators. Look for GET requests to /wp-json/gravitysmtp/v1/tests/mock-data containing the ?page=gravitysmtp-settings parameter.
3. Rotate all exposed credentials. Assume any API keys, OAuth tokens, or email service passwords stored in Gravity SMTP have been compromised.
4. Audit connected third-party services. Check Amazon SES, Google, Mailjet, Resend, and Zoho accounts for unauthorized usage or sent-message anomalies.
5. Implement additional access controls. Consider rate limiting on the WordPress REST API and Web Application Firewall rules for suspicious scanning behavior.
6. Block known malicious IPs. Wordfence has published the most prolific source IP addresses for exploit requests. Add these to your blocklists.

Detection Guidance

Security teams should configure alerts for unauthenticated REST API requests to plugin-specific test endpoints. Furthermore, monitor email service dashboards for unexpected send volume or authentication events from unfamiliar IP addresses. Early detection of abuse limits the window for follow-on phishing and fraud campaigns.

Bottom line: CVE-2026-4020 is a medium-severity flaw with high real-world impact because it requires no authentication and exposes live credentials. Patch Gravity SMTP to 2.1.5 immediately, rotate all exposed secrets, and monitor connected email services for abuse.

Incident Summary

CVE ID / Incident:	CVE-2026-4020
Affected Systems:	Gravity SMTP WordPress plugin versions 2.1.4 and older; 100,000+ active installations
Disclosure Date:	June 19, 2026 (active exploitation confirmed by Wordfence)
Patch Status:	Fixed in Gravity SMTP 2.1.5 (released March 17, 2026)
Severity:	Medium (CVSS); high real-world impact due to active exploitation and credential exposure
Exploitation:	Active in the wild; 17+ million blocked attempts reported by Wordfence

References

1. Wordfence, “Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin,” June 19, 2026, https://www.wordfence.com/blog/2026/06/attackers-actively-exploiting-sensitive-information-exposure-vulnerability-in-gravity-smtp-plugin/, accessed June 20, 2026.
2. BleepingComputer, “Hackers Exploit Info Disclosure Bug in Gravity SMTP WordPress Plugin,” Bill Toulas, June 19, 2026, https://www.bleepingcomputer.com/news/security/hackers-exploit-info-disclosure-bug-in-gravity-smtp-wordpress-plugin/, accessed June 20, 2026.
3. Gravity SMTP, “Changelog and Security Updates,” https://www.gravitysmtp.com/, accessed June 20, 2026.