CVE-2026-4020

Name of the Vulnerable Software and Affected Versions Gravity SMTP versions prior to 2.1.5

Description An information exposure flaw exists in the Gravity SMTP plugin for WordPress, affecting approximately 100,000 sites. The issue stems from a REST API endpoint registered at '/wp-json/gravitysmtp/v1/tests/mock-data' where the permission callback function unconditionally returns true, allowing unauthenticated access. When the page variable is set to 'gravitysmtp-settings' via a query parameter, the register connector data() method populates internal connector data, causing the endpoint to return a JSON dump of approximately 365 KB containing a full System Report. This allows attackers to retrieve sensitive configuration data, including PHP and WordPress versions, web server and database details, active plugins and themes, database table names, and API keys or OAuth tokens for services such as Amazon SES, Google, Mailjet, Resend, and Zoho. Real-world exploitation has been widespread, with reports of over 17 million exploit attempts, leading to incidents where third-party email accounts were locked or abused due to leaked credentials.

Recommendations Update Gravity SMTP to version 2.1.5 or later. Rotate all API keys, passwords, OAuth tokens, and email service credentials that were configured in the plugin prior to the update.