CVE-2026-4020 is an unauthenticated information disclosure vulnerability in the Gravity SMTP WordPress plugin affecting all versions up to 2.1.4. The issue arises because the plugin's REST API endpoint '/wp-json/gravitysmtp/v1/tests/mock-data' has a 'permission_callback' that always returns 'true', allowing unauthenticated GET requests to retrieve a comprehensive JSON system report. This report contains sensitive data including API keys, OAuth tokens, credentials for third-party email services (Amazon SES, Google, Mailjet, Resend, Zoho), WordPress configuration details, server and PHP environment information, and database configuration details. The vulnerability enables attackers to steal email service credentials and gather detailed information about the site’s software stack, facilitating further attacks. The flaw was fixed in version 2.1.5 released on March 17, 2026. Wordfence has reported millions of blocked exploitation attempts since early June 2026.

Exploitation of this vulnerability allows unauthenticated attackers to obtain sensitive information such as API keys, OAuth tokens, and credentials for third-party email services, which can be abused to impersonate the victim and misuse email services. Additionally, detailed system and configuration information exposure lowers the effort required to plan further attacks against the affected site. Although rated medium severity by CVE, the ability to exploit without authentication and the volume of observed exploitation attempts indicate a significant risk to affected sites.

A patch is available and should be applied: upgrade the Gravity SMTP plugin to version 2.1.5 or later. The vulnerability is fixed in this version. Site administrators should also monitor their web server access logs for requests to '/wp-json/gravitysmtp/v1/tests/mock-data' with the '?page=gravitysmtp-settings' parameter as an indicator of compromise. Blocking known malicious IP addresses identified by security vendors like Wordfence can help reduce exploitation attempts. No additional vendor advisory indicates alternative mitigations or that no action is required.