CVE-2026-4020

Gravity SMTP is a WordPress add-on that helps send email using external email services. This bug exposes an “inspection report” page through the plugin’s API that doesn’t require a login, letting outsiders download sensitive details about your server, your WordPress setup, and your email service credentials. Think of it like leaving your company’s “internal settings” binder on a public sidewalk for anyone to read.

This matters if you run WordPress and have the Gravity SMTP plugin installed at version 2.1.4 or below. Because the report can be accessed without a login, any attacker can gather sensitive information from your site if that endpoint is reachable on your internet-facing WordPress site. The risk applies when the plugin is present (and at or below the affected version) and the site is reachable from the internet.

RED: attackers are actively exploiting this issue in the wild to steal sensitive data and perform reconnaissance. The vulnerability is unauthenticated and published as an internet-reachable REST endpoint, which makes it a direct threat to exposed WordPress sites. Treat this as an immediate patch-and-credential-rotation situation.

1. Confirm exposure (quick checks)

   • Log into your WordPress admin and open the Plugins page.
   • Locate “Gravity SMTP” and note the installed version.
   • If your version is 2.1.4 or older, assume you are exposed.

2. Upgrade to the fixed version

   • Upgrade Gravity SMTP to version 2.1.5 (patched per reporting) or later.
   • Perform the upgrade during a maintenance window if needed, but prioritize availability of email delivery; this is a security-driven change.

3. Validate that the endpoint no longer leaks data

   • After upgrading, re-check whether the public REST endpoint that returns the “System Report” still exposes the detailed JSON without authentication.
   • If it still returns the report publicly, treat it as failed remediation and contact the plugin vendor/support immediately.

4. Rotate any exposed credentials

   • Because reports include API keys/OAuth tokens configured in Gravity SMTP, rotate them after patching.
   • Update the plugin’s email service settings with the new keys/tokens and ensure email sending still works.

5. Monitor for follow-on attempts

   • Review WordPress/app logs for unusual requests to the Gravity SMTP REST endpoint path.
   • Watch for signs of account compromise and unexpected changes to plugins/themes and email settings, since the stolen “System Report” helps attackers plan next steps.

6. Timeline guidance

   • Given active exploitation and unauthenticated data exposure, complete upgrade and credential rotation as quickly as possible, ideally immediately.

Severity is High (CVSS 7.5) with a design that allows remote, unauthenticated access to sensitive data (CWE-200). The mechanism is an unauthenticated REST API endpoint in Gravity SMTP that registers a “System Report” data response without requiring a permission check; when invoked with the specific query parameter (page=gravitysmtp-settings), it populates connector data and returns a large JSON payload (~365 KB) containing environment and configuration details, including server information, WordPress/theme/plugin lists, database details, and configured API keys/tokens. Real-world exploitation has been reported as active in the wild, with extensive automated attempts reported and patch availability stated for Gravity SMTP 2.1.5. KEV is not listed for this CVE, and there is no public exploit code on record; however, exploitation is confirmed by reporting, so remediation should not wait for additional maturity signals.