Attackers Exploit Gravity SMTP Vulnerability to Expose Sensitive WordPress Data
Active exploitation of a vulnerability affecting the Gravity SMTP WordPress plugin, a widely used tool that helps websites send emails through external mail services. The flaw, tracked as CVE-2026-4020, allows unauthenticated attackers to access sensitive system information without needing valid credentials. While the vulnerability does not directly provide full control of a website, it can reveal valuable information that may enable attackers to conduct further attacks.
What makes this vulnerability particularly concerning is the type of information exposed. Affected websites may unintentionally disclose API keys, SMTP credentials, OAuth tokens, server details, installed plugins, database information and other configuration data through an improperly secured REST API endpoint. This effectively provides attackers with a detailed blueprint of the target environment, helping them identify additional weaknesses or compromise connected services.
Unlike traditional attacks that focus on malware deployment or remote code execution, this campaign relies on information gathering and reconnaissance. Although information disclosure vulnerabilities are often perceived as lower risk, exposed credentials and system details can become powerful tools for threat actors. Security monitoring organizations have observed significant exploitation activity, with millions of attack attempts blocked as cybercriminals increasingly automate the discovery of vulnerable websites.
Attack Surface
Content Management System, Web Application
Tactics
Collection, Exfiltration, Reconnaissance
Techniques
- T1082 – System Information Discovery
- T1582 – Exploit Poorly Configured Endpoint
SuperPRO's Threat Countermeasures Procedures
- Update the Gravity SMTP plugin to version 2.1.5 or later
- Check server access logs for requests to the affected endpoint
- Rotate API keys, secrets, and OAuth tokens for third-party email integrations
- Monitor for suspicious activity, such as unusual GET requests to the vulnerable endpoint
- Implement authentication and capability checks for REST API endpoints
- Keep software and plugins up to date to prevent exploitation of known vulnerabilities