VulnerabilityPublished 22 Jun 2026

Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

Source SecurityWeek

Mentioned vulnerabilities

CVE-2026-4020

Fixed in 2.1.5 : update affected systems when convenient.

Data as of 22 Jun 2026, 17:14 UTC

Severity

Medium

Rated by Threat Radar

Patch: Available – fixed in 2.1.5

What to do

AI-suggested

An official fix is available in Gravity SMTP plugin version 2.1.5. Site administrators should update to this version immediately. After updating, any API keys, secrets, or OAuth tokens configured for third-party email integrations (e.g., Amazon SES, Google, Mailjet, Resend, Zoho) should be rotated to prevent misuse. Administrators should also review server access logs for requests to the vulnerable REST API endpoint to identify potential exploitation attempts. No other mitigation is indicated by the vendor advisory.

Description

Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data appeared first on SecurityWeek .

Impact

Attackers can obtain sensitive information such as API keys, OAuth tokens, server configuration, and WordPress details without authentication. This exposure allows unauthorized sending of emails using the compromised site's credentials and facilitates detailed reconnaissance that can lead to further targeted attacks. The data leak compromises the confidentiality of critical credentials and system information, increasing the risk of account takeover, phishing, spam abuse, and subsequent exploitation of other vulnerabilities.

Summary

The Gravity SMTP WordPress plugin versions before 2.1.5 contain a sensitive information exposure vulnerability (CVE-2026-4020) with a CVSS score of 5.3. The vulnerability exists because a REST API endpoint in the plugin's shared configuration library does not enforce authentication or capability checks, allowing any unauthenticated user to query it. When a specific parameter is appended, the endpoint returns a JSON object containing detailed system and configuration data, including PHP and WordPress versions, loaded extensions, server details, database information, active plugins and themes, and configured API keys and tokens for third-party email services. This data leakage enables attackers to send emails on behalf of the compromised site and perform detailed reconnaissance for further exploitation. Exploitation has been observed since early May 2026, with over 17 million exploit attempts blocked by security firm Defiant. The vulnerability is actively exploited in the wild, with a surge in attacks noted in June 2026.

References

securityweek.com/attackers-exploit-gravity-smtp-plugin-flaw-to-harvest-valuable-wordpress-data/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 22 Jun 2026, 11:54 UTC

References

Community reviews

Related threats