The Gravity SMTP plugin for WordPress versions up to 2.1.4 contains a sensitive information exposure vulnerability (CWE-200) due to an insecure REST API endpoint. The endpoint /wp-json/gravitysmtp/v1/tests/mock-data is accessible without authentication because its permission_callback function unconditionally returns true. When accessed with the query parameter ?page=gravitysmtp-settings, the plugin returns a large JSON payload with detailed system and configuration data, including software versions, active plugins and themes, database details, and API keys configured in the plugin. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity.

An unauthenticated attacker can retrieve extensive sensitive information about the WordPress environment and server configuration, including API keys and tokens. This information disclosure can facilitate further targeted attacks or exploitation by revealing system details that are normally restricted. There is no indication of direct code execution or data modification, but the confidentiality breach is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoint by disabling or limiting access to the Gravity SMTP plugin's REST routes, or remove the plugin if not in use. Monitor vendor channels for updates and apply patches promptly once released.