CVE-2026-4020

CVE-2026-4020 is an unauthenticated sensitive information exposure (CWE-200) in the Gravity SMTP plugin for WordPress, affecting all versions up to and including 2.1.4. The plugin registers a REST route at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, so any anonymous visitor can call it; when the ?page=gravitysmtp-settings parameter is appended, the register_connector_data() method populates internal connector data and the endpoint returns roughly 365 KB of JSON containing the full System Report. An unauthenticated attacker therefore gains detailed configuration information, including PHP and WordPress versions, loaded extensions, web server and database server type and version, document root, database table names, all active plugins with versions, the active theme, WordPress configuration details, and any API keys or tokens configured in the plugin, which can enable follow-on attacks. Any WordPress site running Gravity SMTP 2.1.4 or earlier is affected, and related reporting indicates attackers are already exploiting the bug in the wild to expose API keys, with EPSS estimating a 40% probability of exploitation within 30 days (99th percentile).

What to do: Update Gravity SMTP to the latest available patched release (any version newer than 2.1.4) as soon as possible. Until patched, block or restrict unauthenticated access to /wp-json/gravitysmtp/v1/tests/mock-data, for example via WAF rules or REST API restrictions. Rotate any API keys or tokens configured in the plugin and review web server logs for requests to the endpoint, since in-the-wild attacks are already exposing keys.