Over 100,000 WordPress Sites at Risk from Unauthenticated Info Disclosure in Gravity SMTP Plugin

Summary

Threat actors are exploiting a critical vulnerability in the Gravity SMTP WordPress plugin, which affects all versions from 2.1.4 and older. This unauthenticated information disclosure flaw allows attackers to access sensitive data such as API keys, server configurations, and third-party service credentials. The issue was addressed in version 2.1.5, released on March 17. Despite its medium severity rating, the vulnerability poses a significant risk due to the ease of exploitation and potential for further attacks.

What Happened

The Gravity SMTP WordPress plugin is being exploited by hackers who are taking advantage of an unauthenticated information disclosure vulnerability. This flaw stems from an exposed REST API endpoint that allows GET requests without authentication, providing attackers with a comprehensive JSON "System Report." The report includes sensitive data such as API keys, secrets, OAuth tokens, and server configurations.

Technical Details

The vulnerability is tracked as CVE-2026-4020 and has been assigned a medium severity rating. It affects all versions of the Gravity SMTP plugin from 2.1.4 and older. The issue arises because the 'permission_callback' for the exposed REST API endpoint always returns 'true,' allowing unauthenticated access to sensitive information.

Affected Products and Fixed Versions

The vulnerability impacts all versions of the Gravity SMTP WordPress plugin up to 2.1.4. The issue has been addressed in version 2.1.5, released on March 17. Site administrators are urged to update their plugins immediately to mitigate the risk.

Exploitation Status

Defiant's Wordfence firewall has blocked over 17 million attempts against protected customers, indicating active exploitation of the vulnerability. The company reported a spike in exploitation activity on June 7, with 4 million requests being blocked that day alone.

Indicators of Compromise

A key indicator of compromise is requests to /wp-json/gravitysmtp/v1/tests/mock-data found in web server access logs, particularly those including the ?page=gravitysmtp-settings query parameter. Website administrators should monitor their logs for such activity and add prolific source IP addresses to their blocklists.

Detection Opportunities

Security teams can use Wordfence's firewall rules to detect and block exploitation attempts. Monitoring web server access logs for suspicious requests to the Gravity SMTP REST API endpoint is crucial for early detection of potential breaches.

Why This Matters for Defenders

The exposure of sensitive information through this vulnerability allows attackers to impersonate victims and gain detailed insights into the site's software stack, facilitating further attacks. Immediate action is required to update the plugin and secure exposed data.

What Remains Unclear

While the exploitation activity has been documented, specific details about the threat actors and their motives remain unclear. Additionally, the full extent of the impact on affected sites is yet to be determined.

Defender Guidance

1. Update Immediately: Site administrators should update Gravity SMTP to version 2.1.5 or later to patch the vulnerability.
2. Monitor Logs: Regularly review web server access logs for suspicious requests to /wp-json/gravitysmtp/v1/tests/mock-data.
3. Block Malicious IPs: Add prolific source IP addresses identified by Wordfence to your blocklists.
4. Review API Credentials: Change any exposed API keys, secrets, and OAuth tokens to prevent unauthorized access.

By taking these steps, defenders can mitigate the risk posed by this vulnerability and protect their sites from further exploitation.