CVE-2026-4020: Gravity SMTP WordPress Plugin Unauthenticated System-Report Credential Disclosure (Actively Exploited) — Threadlinqs Intelligence
As of 2026-06-19, CVE-2026-4020: Gravity SMTP WordPress Plugin Unauthenticated System-Report Credential Disclosure (Actively Exploited) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0875 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: VULNERABILITY
An unauthenticated sensitive-information-disclosure flaw (CVE-2026-4020, CWE-200) in the RocketGenius Gravity SMTP WordPress plugin (versions up to and including 2.1.4) lets any attacker retrieve a
CVE-2026-4020 is an unauthenticated sensitive information exposure vulnerability in the Gravity SMTP plugin for WordPress (developed by RocketGenius, the makers of Gravity Forms), affecting all versions up to and including 2.1.4 and installed on more than 100,000 WordPress sites. The flaw resides in a REST API route the plugin registers at /wp-json/gravitysmtp/v1/tests/mock-data. The route's permission_callback unconditionally returns true, performing no authentication and no capability verification, so any unauthenticated visitor on the public internet can invoke it.
When the request includes the query parameter page=gravitysmtp-settings, the plugin's register_connector_data() method populates internal connector configuration and the endpoint returns an approximately 365 KB JSON 'System Report'. This report was designed as a support/diagnostics artifact but discloses a large volume of sensitive data: PHP version and loaded extensions, web server version and document root path, database server type/version and internal table names, the WordPress version and configuration details, the active theme, and the complete list of active plugins with version numbers. Most critically, the report includes the plugin's configured email-integration secrets: SMTP credentials, and API keys / secrets / OAuth tokens for providers such as Amazon SES, Google, Mailjet, Resend, Zoho, SendGrid, and Mailgun, as well as configured DKIM tokens. Disclosure of these provider credentials enables downstream account takeover of the victim's email infrastructure, allowing attackers to send authenticated email (phishing, BEC, spam) from the victim's trusted sending domains, and the broad environment fingerprint lets attackers craft follow-on exploits against other known-vulnerable components.
Exploitation is trivial and fully automatable: a single unauthenticated HTTP GET request retrieves the secrets, and detection/exploit templates are already published for public tooling such as ProjectDiscovery Nuclei, fueling mass opportunistic scanning. The vendor released the fix in Gravity SMTP 2.1.5 on March 17, 2026 (the patch is effectively a one-line change adding a proper capability check to the permission_callback). The CVE was published March 31, 2026. CrowdSec shipped detection coverage on May 22, 2026 and recorded the first in-the-wild exploitation on May 27, 2026, observing 412 distinct attacking IPs between May 27 and June 1 — predominantly cloud/hosting infrastructure across France, the Netherlands, and the United States — with commerce environments (~55%) and SOHO deployments (~39%) most targeted and infrastructure-takeover the dominant intent (~83%). Wordfence subsequently blocked over 17 million exploitation attempts, peaking June 7-11, 2026 at several million requests per day from a widely distributed IP base.
Note on scoring: sources disagree on severity. The NVD / GitHub Advisory (GHSA-jxfc-8wcq-xxcg) assign CVSS 3.1 base score 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Wordfence rated the issue 5.3 (MEDIUM). The discrepancy reflects differing confidentiality-impact weighting (full credential exposure vs. partial information disclosure); this record adopts the authoritative NVD/GHSA 7.5/HIGH scoring given that exposed secrets permit full email-provider account takeover.
Weaknesses (CWE)
CWE-200, CWE-862
Target sectors: e-commerce, small-business, hosting, general
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-4020, T1595, T1595.002, T1592, T1596, T1583, T1588, T1588.002, T1190, T1552, T1552.001