CVE-2026-4020: Gravity SMTP WordPress Plugin Unauthenticated System-Report Credential Disclosure (Actively Exploited)

CVE-2026-4020 (TL-2026-0875), also tracked as GHSA-jxfc-8wcq-xxcg, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-06-19. It has no confirmed attribution, affects RocketGenius (Gravity Forms) Gravity SMTP (WordPress plugin), references 1 CVE (CVE-2026-4020), maps to 17 MITRE ATT&CK techniques (T1082, T1119, T1190), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-0875

Threat ID
TL-2026-0875
Also known as
GHSA-jxfc-8wcq-xxcg, Gravity SMTP System Report Disclosure
Severity
HIGH
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-19
Last reviewed
2026-06-19
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
e-commerce, small-business, hosting, general
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in CVE-2026-4020

Malware and tooling: Nuclei (ProjectDiscovery) CVE-2026-4020 template

An unauthenticated sensitive-information-disclosure flaw (CVE-2026-4020, CWE-200) in the RocketGenius Gravity SMTP WordPress plugin (versions up to and including 2.1.4) lets any attacker retrieve a ~365 KB JSON System Report exposing email-integration API keys, secrets, and OAuth tokens via a single GET request. Wordfence reports 17M+ blocked attempts with peak activity June 7-11, 2026; CrowdSec observed 412 distinct attacking IPs and first in-the-wild exploitation on May 27, 2026.

How CVE-2026-4020 works

CVE-2026-4020 is an unauthenticated sensitive information exposure vulnerability in the Gravity SMTP plugin for WordPress (developed by RocketGenius, the makers of Gravity Forms), affecting all versions up to and including 2.1.4 and installed on more than 100,000 WordPress sites. The flaw resides in a REST API route the plugin registers at /wp-json/gravitysmtp/v1/tests/mock-data. The route's permission_callback unconditionally returns true, performing no authentication and no capability verification, so any unauthenticated visitor on the public internet can invoke it.

When the request includes the query parameter page=gravitysmtp-settings, the plugin's register_connector_data() method populates internal connector configuration and the endpoint returns an approximately 365 KB JSON 'System Report'. This report was designed as a support/diagnostics artifact but discloses a large volume of sensitive data: PHP version and loaded extensions, web server version and document root path, database server type/version and internal table names, the WordPress version and configuration details, the active theme, and the complete list of active plugins with version numbers. Most critically, the report includes the plugin's configured email-integration secrets: SMTP credentials, and API keys / secrets / OAuth tokens for providers such as Amazon SES, Google, Mailjet, Resend, Zoho, SendGrid, and Mailgun, as well as configured DKIM tokens. Disclosure of these provider credentials enables downstream account takeover of the victim's email infrastructure, allowing attackers to send authenticated email (phishing, BEC, spam) from the victim's trusted sending domains, and the broad environment fingerprint lets attackers craft follow-on exploits against other known-vulnerable components.

Exploitation is trivial and fully automatable: a single unauthenticated HTTP GET request retrieves the secrets, and detection/exploit templates are already published for public tooling such as ProjectDiscovery Nuclei, fueling mass opportunistic scanning. The vendor released the fix in Gravity SMTP 2.1.5 on March 17, 2026 (the patch is effectively a one-line change adding a proper capability check to the permission_callback). The CVE was published March 31, 2026. CrowdSec shipped detection coverage on May 22, 2026 and recorded the first in-the-wild exploitation on May 27, 2026, observing 412 distinct attacking IPs between May 27 and June 1 — predominantly cloud/hosting infrastructure across France, the Netherlands, and the United States — with commerce environments (~55%) and SOHO deployments (~39%) most targeted and infrastructure-takeover the dominant intent (~83%). Wordfence subsequently blocked over 17 million exploitation attempts, peaking June 7-11, 2026 at several million requests per day from a widely distributed IP base.

Note on scoring: sources disagree on severity. The NVD / GitHub Advisory (GHSA-jxfc-8wcq-xxcg) assign CVSS 3.1 base score 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Wordfence rated the issue 5.3 (MEDIUM). The discrepancy reflects differing confidentiality-impact weighting (full credential exposure vs. partial information disclosure); this record adopts the authoritative NVD/GHSA 7.5/HIGH scoring given that exposed secrets permit full email-provider account takeover.

MITRE ATT&CK techniques used in TL-2026-0875

Discovery

T1082 System Information Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery

Collection

T1119 Automated Collection; T1602 Data from Configuration Repository

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1531 Account Access Removal

Credential Access

T1552 Unsecured Credentials; T1552.001 Credentials In Files

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1588.002 Tool

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

Affected products and versions in CVE-2026-4020

  • RocketGenius (Gravity Forms) — Gravity SMTP (WordPress plugin)
    Vulnerable versions: <= 2.1.4
    Fixed in: 2.1.5

Remediation for CVE-2026-4020

Patches

  • Gravity SMTP 2.1.5 (released 2026-03-17) — adds a capability check to the vulnerable REST permission_callback.

Immediate actions

  • Upgrade Gravity SMTP to version 2.1.5 or later on all WordPress sites immediately.
  • Rotate ALL API keys, secrets, and OAuth tokens for connected email providers (Amazon SES, Google, Mailjet, Resend, Zoho, SendGrid, Mailgun) and rotate SMTP credentials and DKIM tokens, as they must be presumed compromised if the site ran a vulnerable version while internet-exposed.
  • Review email-provider send logs and access logs for unauthorized activity following potential credential theft.

Workarounds

  • Block or 403 the path /wp-json/gravitysmtp/v1/tests/mock-data at the web server, reverse proxy, or WAF.
  • Disable or remove the Gravity SMTP plugin until patched if an upgrade cannot be applied.

Longer-term hardening

  • Deploy a WAF/virtual patch blocking unauthenticated requests to /wp-json/gravitysmtp/v1/tests/mock-data.
  • Restrict WordPress REST API access to trusted IP ranges or authenticated sessions where feasible.
  • Adopt a managed plugin-update / vulnerability-monitoring program for WordPress estates.
  • Avoid storing long-lived provider secrets in plugin config where scoped/rotatable credentials are available.

CVEs associated with CVE-2026-4020

CVE-2026-4020

Weaknesses (CWE) in CVE-2026-4020

CWE-200, CWE-862

Timeline of CVE-2026-4020

  • RocketGenius releases Gravity SMTP 2.1.5, adding a capability check to the vulnerable REST permission_callback.
  • CVE-2026-4020 / GHSA-jxfc-8wcq-xxcg published; NVD assigns CVSS 7.5 (HIGH), Wordfence rates 5.3 (MEDIUM).
  • CrowdSec ships detection coverage for the mock-data endpoint exploitation.
  • CrowdSec records first in-the-wild exploitation attempts.
  • CrowdSec reports 412 distinct attacking IPs over the May 27-June 1 window; commerce (~55%) and SOHO (~39%) sites most targeted, ~83% infrastructure-takeover intent.
  • Wordfence-observed exploitation surge begins, reaching several million requests per day.
  • Peak attack activity; cumulative blocked attempts exceed 17 million from a widely distributed IP base.
  • Public reporting (Cyber Security News, GBHackers) details mass credential-harvesting campaign against 100,000+ installs.

Sources cited for CVE-2026-4020

Threats related to CVE-2026-4020

Detection coverage for TL-2026-0875

As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0875 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats