Critical Vulnerability in WordPress SMTP Plugin Actively Exploited

Key Takeaways

• A critical information exposure vulnerability (CVE‑2026‑4020) in the Gravity SMTP WordPress plugin is under active, widespread exploitation.
• Over 100,000 WordPress sites using Gravity SMTP versions up to 2.1.4 are at risk of having sensitive configuration data and live email credentials stolen.
• The flaw allows unauthenticated attackers to retrieve a “System Report” containing API keys, secrets, OAuth tokens for email services, and extensive system metadata.
• A patch was released on March 17, 2026, in Gravity SMTP version 2.1.5; immediate upgrade and credential rotation are advised.

WordPress Plugin Flaw Actively Exploited to Steal Email Credentials

A severe vulnerability within the Gravity SMTP WordPress plugin is currently being exploited in the wild, enabling threat actors to extract sensitive configuration data and active email credentials from over 100,000 affected websites. This critical flaw allows unauthenticated attackers to gain access to information that could lead to full compromise of email sending capabilities.

Vulnerability Details and Exploitation

Designated as CVE‑2026‑4020, the vulnerability carries a CVSS score of 5.3 (Medium) and impacts all versions of the Gravity SMTP plugin up to and including 2.1.4. Distributed IP infrastructure from various global regions is now actively leveraging this weakness for mass exploitation.

The core of the issue lies in an insecure REST API endpoint, /wp-json/gravitysmtp/v1/tests/mock-data. This endpoint features a permission callback that unconditionally returns true, effectively bypassing all authentication and capability checks. Consequently, any unauthenticated visitor can access it.

When a request to this endpoint includes the query parameter page=gravitysmtp-settings, the plugin’s internal logic for collecting configuration data is triggered. This action causes the plugin to generate and return a roughly 365 KB JSON “System Report.” This report is highly detailed, containing extensive system and plugin metadata, including PHP version and extensions, web server details, database type and version, WordPress configuration, active theme, a list of all active plugins with their versions, and internal database table names.

Crucially, the System Report also exposes API keys, secrets, and OAuth tokens configured for Gravity SMTP’s various email integrations. This includes credentials for popular providers such as Amazon SES, Google, Mailjet, Resend, and Zoho. Such exposure provides attackers with all necessary information to send emails through the victim’s legitimate channels, facilitating phishing, spam, or further malicious activities.

The combination of comprehensive reconnaissance data and direct credential exposure significantly reduces the effort required for attackers to chain additional vulnerabilities or pivot towards broader account compromise.

Widespread Attack Campaigns Detected

Exploitation of this vulnerability is straightforward, requiring only a single unauthenticated GET request, such as GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1, followed by parsing the returned JSON. The absence of authentication, CSRF protection, or capability checks makes this pattern ideal for automated, internet-wide scanning and harvesting. Exploit templates are already readily available in public tooling ecosystems like Nuclei.

Security firm Wordfence has reported widespread exploitation of the Gravity SMTP flaw, noting over 17 million blocked attack attempts. A significant surge in activity was observed between June 7–11, 2026, with several million requests per day. Similarly, CrowdSec identified at least 412 distinct attacking IP addresses between May 27 and June 1, 2026, with top activity originating from cloud and hosting geographies rather than localized clusters.

Among the most aggressive IP addresses observed targeting the vulnerable mock-data endpoint are 45.148.10.95, 193.32.162.60, 176.65.148.139, 173.199.90.188, 45.148.10.120, 185.8.107.155, 185.8.106.37, 185.8.106.92, 185.8.106.145, and 176.65.148.30. Each of these has been responsible for hundreds of thousands of blocked requests. These addresses are linked to high-volume scanning infrastructure, indicating automated and opportunistic exploitation rather than actions by ordinary residential users. Defenders should consider this list indicative, as new attacking IPs are continuously emerging.

Detection Challenges and Remediation

Detecting exploitation of CVE‑2026‑4020 presents a challenge because it is a read-only vulnerability that does not directly alter site content, users, or files. Consequently, typical indicators of compromise, such as new administrator accounts or dropped webshells, may be absent even after credentials have been stolen.

Administrators should instead examine web server access logs for any requests to /wp-json/gravitysmtp/v1/tests/mock-data, particularly those including page=gravitysmtp-settings. Correlating these requests with timestamps, user agents, and known malicious IPs can help identify compromise. The presence of large 365 KB JSON responses from this path is strong evidence that the system report has been retrieved.

What You Should Do

• Update Immediately: Upgrade the Gravity SMTP plugin to version 2.1.5 or later without delay. This version contains the patch for the insecure REST API behavior.
• Rotate Credentials: Given the high likelihood of credential exposure, immediately rotate all API keys, secrets, and OAuth tokens associated with Amazon SES, Google, Mailjet, Resend, Zoho, and any other email providers configured with Gravity SMTP.
• Monitor Logs: Regularly review web server access logs for requests to /wp-json/gravitysmtp/v1/tests/mock-data, especially those with the page=gravitysmtp-settings parameter. Look for large JSON responses (around 365 KB) from this endpoint.
• Implement WAF Rules: Consider blocking unauthenticated access to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint via web server configuration or Web Application Firewall (WAF) rules.
• Restrict REST API Access: Where feasible, limit REST API access to trusted IP ranges to further reduce exposure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.