Threat actors are actively exploiting a recently patched information disclosure vulnerability in the Gravity SMTP WordPress plugin, a tool installed on an estimated 100,000 websites, to harvest API keys and other sensitive configuration data. The flaw, identified as CVE-2026-4020 and carrying a CVSS score of 5.3, allows unauthenticated attackers to access a REST API endpoint that leaks a comprehensive system report, exposing everything from database credentials to active third-party email service tokens. This incident underscores how even medium-severity vulnerabilities can serve as powerful initial access vectors when the exposed data includes live credentials for critical services.<\/p>\n
At its core, the vulnerability resides in a REST API endpoint registered at The information returned to an unauthenticated attacker is extensive and highly damaging. It includes not only software stack configuration but also live authentication secrets. The exposed data covers:<\/p>\n Because the exploit requires no authentication, any site running a vulnerable version of Gravity SMTP (prior to version 2.1.5) was effectively broadcasting its internal configuration and credentials to anyone who made the right HTTP request.<\/p>\n Security researchers from Wordfence<\/a> have observed active exploit attempts since the beginning of May 2026<\/a>, with activity spiking dramatically around June<\/a> 6 and reaching over 4 million blocked requests in a single day. The attackers are sending unauthenticated HTTP GET requests to the vulnerable REST API endpoint with the The exploit attempts have been traced to a set of IP addresses, including: 45.148.10.95, 193.32.162.60, 176.65.148.139, 173.199.90.188, 45.148.10.120, 185.8.107.155, 185.8.106.37, 185.8.106.92, 185.8.106.145, and 176.65.148.30.<\/p>\n While the CVSS score classifies this as a medium-severity issue, the practical impact can be severe. The exposure of live third-party API credentials means an attacker could abuse the site\u2019s connected email services to send malicious emails on behalf of the organization, potentially leading to phishing attacks against the site\u2019s users, partners, or customers. Furthermore, the detailed system report\u2014including database table names, plugin versions, and the entire software stack\u2014significantly lowers the effort required to plan follow-on attacks. An attacker armed with this information can identify other vulnerabilities in the site\u2019s specific software versions and execute targeted exploits with a much higher success rate.<\/p>\n As one security analysis noted, the impact ultimately depends on what specific data is exposed for each individual site. In cases where API keys for services like Amazon SES or Google are leaked, the potential for credential abuse is immediate and actionable for the attacker.<\/p>\n A fix for CVE-2026-4020 has been released in Gravity SMTP version 2.1.5. Site owners who have configured third-party email integrations within the plugin should assume compromise if they were running a vulnerable version. The first priority is to update the plugin to the latest version immediately.<\/p>\n\/wp-json\/gravitysmtp\/v1\/tests\/mock-data<\/code>codecodecodecode. The plugin\u2019s permission callback for this endpoint was coded to unconditionally return true, meaning any unauthenticated visitor to a WordPress site could access it. When the specific query parameter ?page=gravitysmtp-settings<\/code>codecodecodecode is appended to the request, the plugin\u2019s register_connector_data()<\/code>codecodecodecode method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON output containing the full System Report.<\/p>\nWhat Data Does This Vulnerability Expose?<\/h3>\n
\n
How Attackers Are Exploiting the Gravity SMTP Bug<\/h2>\n
?page=gravitysmtp-settings<\/code>codecodecodecode parameter. This triggers the server to return the verbose system report without any login requirement.<\/p>\nWhy This Information Disclosure Matters<\/h2>\n
Patch Status and Update Guidance<\/h2>\n
What Affected Users Should Do Now<\/h2>\n