Reported by 1 outlet
Gravity SMTP Plugin (CVE-2026-4020) — Unauthenticated Info Disclosure Exploited at Scale, 17M+ Wordfence Blocks
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Gravity SMTP Plugin (CVE-2026-4020) — Unauthenticated Info Disclosure Exploited at Scale, 17M+ Wordfence Blocks
bleepingcomputer.com · 116d ago · June 20th, 2026
Threat actors are actively exploiting CVE-2026-4020, a medium-severity (CVSS 5.3) unauthenticated information disclosure vulnerability in the Gravity SMTP WordPress plugin (100,000+ active installs). The flaw stems from an exposed REST API endpoint (
/wp-json/gravitysmtp/v1/tests/mock-data) whosepermission_callbackalways returnstrue, allowing any unauthenticated visitor to extract a comprehensive JSON system report containing:-
API keys, secrets, and OAuth tokens for configured email integrations (Amazon SES, Google, Mailjet, Resend, Zoho)
-
WordPress configuration details (installed plugins, themes, software versions)
-
Database configuration (server version, table names)
-
PHP environment information
Wordfence has blocked over 17 million exploit attempts against protected customers, with a spike of 4 million on June 7 alone. Successful exploitation allows attackers to impersonate the victim organization via email services and perform reconnaissance for follow-on attacks. All plugin versions 2.1.4 and older are affected; patched in version 2.1.5 (released March 17).
Indicator: Requests to
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settingsin web server access logs.Recommended action: Update to Gravity SMTP ≥ 2.1.5 immediately. Rotate any email service API keys and OAuth tokens that may have been exposed.
-