# CVE-2026-4020: Gravity SMTP WordPress Plugin Unauthenticated System-Report Credential Disclosure (Actively Exploited)

> An unauthenticated sensitive-information-disclosure flaw (CVE-2026-4020, CWE-200) in the RocketGenius Gravity SMTP WordPress plugin (versions up to and including 2.1.4) lets any attacker retrieve a ~365 KB JSON System Report exposing email-integration API keys, secrets, and OAuth tokens via a single GET request. Wordfence reports 17M+ blocked attempts with peak activity June 7-11, 2026; CrowdSec observed 412 distinct attacking IPs and first in-the-wild exploitation on May 27, 2026.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0875
- **ID:** TL-2026-0875
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-4020

## Description

CVE-2026-4020 is an unauthenticated sensitive information exposure vulnerability in the Gravity SMTP plugin for WordPress (developed by RocketGenius, the makers of Gravity Forms), affecting all versions up to and including 2.1.4 and installed on more than 100,000 WordPress sites. The flaw resides in a REST API route the plugin registers at /wp-json/gravitysmtp/v1/tests/mock-data. The route's permission_callback unconditionally returns true, performing no authentication and no capability verification, so any unauthenticated visitor on the public internet can invoke it.

When the request includes the query parameter page=gravitysmtp-settings, the plugin's register_connector_data() method populates internal connector configuration and the endpoint returns an approximately 365 KB JSON 'System Report'. This report was designed as a support/diagnostics artifact but discloses a large volume of sensitive data: PHP version and loaded extensions, web server version and document root path, database server type/version and internal table names, the WordPress version and configuration details, the active theme, and the complete list of active plugins with version numbers. Most critically, the report includes the plugin's configured email-integration secrets: SMTP credentials, and API keys / secrets / OAuth tokens for providers such as Amazon SES, Google, Mailjet, Resend, Zoho, SendGrid, and Mailgun, as well as configured DKIM tokens. Disclosure of these provider credentials enables downstream account takeover of the victim's email infrastructure, allowing attackers to send authenticated email (phishing, BEC, spam) from the victim's trusted sending domains, and the broad environment fingerprint lets attackers craft follow-on exploits against other known-vulnerable components.

Exploitation is trivial and fully automatable: a single unauthenticated HTTP GET request retrieves the secrets, and detection/exploit templates are already published for public tooling such as ProjectDiscovery Nuclei, fueling mass opportunistic scanning. The vendor released the fix in Gravity SMTP 2.1.5 on March 17, 2026 (the patch is effectively a one-line change adding a proper capability check to the permission_callback). The CVE was published March 31, 2026. CrowdSec shipped detection coverage on May 22, 2026 and recorded the first in-the-wild exploitation on May 27, 2026, observing 412 distinct attacking IPs between May 27 and June 1 — predominantly cloud/hosting infrastructure across France, the Netherlands, and the United States — with commerce environments (~55%) and SOHO deployments (~39%) most targeted and infrastructure-takeover the dominant intent (~83%). Wordfence subsequently blocked over 17 million exploitation attempts, peaking June 7-11, 2026 at several million requests per day from a widely distributed IP base.

Note on scoring: sources disagree on severity. The NVD / GitHub Advisory (GHSA-jxfc-8wcq-xxcg) assign CVSS 3.1 base score 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Wordfence rated the issue 5.3 (MEDIUM). The discrepancy reflects differing confidentiality-impact weighting (full credential exposure vs. partial information disclosure); this record adopts the authoritative NVD/GHSA 7.5/HIGH scoring given that exposed secrets permit full email-provider account takeover.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1596 Search Open Technical Databases
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1518 Software Discovery
- T1526 Cloud Service Discovery
- T1602 Data from Configuration Repository
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Hackers Exploiting WordPress SMTP Plugin to Harvest Credentials](https://cybersecuritynews.com/hackers-exploiting-wordpress-smtp-plugin/)
- [CVE-2026-4020: Gravity SMTP Information Disclosure Under Active Exploitation](https://www.crowdsec.net/vulntracking-report/cve-2026-4020-gravity-smtp-information-disclosure)
- [GitHub Advisory Database GHSA-jxfc-8wcq-xxcg](https://github.com/advisories/GHSA-jxfc-8wcq-xxcg)
- [NVD - CVE-2026-4020](https://nvd.nist.gov/vuln/detail/cve-2026-4020)
- [CVE-2026-4020: Gravity SMTP Plugin Information Disclosure](https://www.sentinelone.com/vulnerability-database/cve-2026-4020/)
- [Hackers Exploit WordPress SMTP Plugin With 100,000+ Installs to Steal Sensitive Data](https://gbhackers.com/hackers-exploit-wordpress-smtp-plugin/)
- [CVE-2026-4020 gravitysmtp 2.1.4 Proof of Concept](https://atomicedge.io/cve-proof/cve-2026-4020-gravitysmtp-version-2-1-4-high-vulnerability-proof-of-concept/)
- [WordPress SMTP Plugin Security Risk: CVE-2026-4020 (API Key Exposure)](https://benryan.com.au/blog/gravity-smtp-cve-2026-4020-api-key-exposure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0875