Security Brief: Gravity SMTP WordPress info disclosure
https://vulnify.app/blog/security-brief-gravity-smtp-info-disclosure

Gravity SMTP for WordPress (CVE-2026-4020) exposed email API keys without a login. Update past 2.1.4, rotate connector secrets, and review logs for the public REST test route.

Attackers are probing WordPress sites that still run an old Gravity SMTP build and walking away with email-connector secrets. The flaw does not need a login. If that plugin is installed and you have not moved past 2.1.4, treat the mail integration as readable and fix it this week. This brief covers what vendors confirmed, why leaked SMTP keys are a site-owner problem, and what to check on property you own. What happened CVE-2026-4020 is an unauthenticated information-disclosure bug in the Gravity SMTP plugin. Wordfence, which filed the CVE, says a public REST route returned the plugin’s system report to anyone who could reach it. That report can include API keys, secrets, and OAuth tokens for mail connectors, plus WordPress, PHP, and server inventory. Independent coverage on 19 June 2026 said the same issue is under active attack. Affected builds are Gravity SMTP through 2.1.4. The vendor shipped 2.1.5 on 25 March 2026 with a security note in the changelog. Some news write-ups list 17 March for that release. Confirm the date on the official changelog before you quote it. Later 2.2.x and 2.3.x builds also exist; owners should not stop at the first patched tag if a newer current release is available. Wordfence disclosed the issue on 30 March 2026 and later said exploit traffic rose in May and surged in June. Defiant’s firewall reporting, repeated by BleepingComputer and SecurityWeek, puts blocked attempts in the tens of millions. Those are vendor-observed blocks on protected customers, not a count of successful thefts. The useful owner signal is simpler: the path is unauthenticated, and a patch has been out for months. Wordfence told operators to search access logs for requests to the Gravity SMTP REST test route /wp-json/gravitysmtp/v1/tests/mock-data . That string is an indicator to hunt in logs you already keep. It is not a reason to poke other people’s sites. Do not test it on hosts you do not own or do not have written permission to assess. Why it matters for website owners Gravity SMTP sits on the outbound mail path: password resets, order receipts, form notices, and staff alerts. If an attacker copies a live Amazon SES, Google, Mailjet, Resend, or Zoho token, they can send mail that looks like yours. Recipients then treat phishing as a normal message from your brand. Updating the plugin closes the leak. It does not revoke keys that already left the server. The same report also maps the stack: WordPress version, active plugins, theme, PHP, and database labels. That is a shopping list for the next cheap attack. Owners who only bump the plugin and skip credential rotation leave the more valuable prize in the attacker’s pocket. Agencies and hosts should inventory every WordPress copy, including staging and forgotten subdomains. A patched production site does not help if an old 2.1.4 clone is still reachable. Work only on sites you operate or have written permission to test. What to check on your site In WordPress admin, open Plugins and confirm whether Gravity SMTP is installed. Write down the exact version. Anything through 2.1.4 is in the published affected range. Update to 2.1.5 or newer. The vendor changelog listed 2.3.2 as current in early August 2026. Prefer the latest current build after a backup, not a one-version bump if you are months behind. If any third-party mail connector was configured while the site was on 2.1.4 or older, rotate those API keys, secrets, and OAuth tokens at the provider. Then save the new values in Gravity SMTP. Assume old tokens are burned. Review outbound mail activity at the provider for sends you did not make. Watch for new identities, new regions, or a sudden spike after May 2026. Search web-server access logs for gravitysmtp/v1/tests/mock-data . Treat hits as a reason to rotate keys, not as proof that nothing else happened. Run the WordPress Stack Checker on the public hostname, then the WordPress Vulnerability Scanner landing flow for a WordPress-specific pass. Follow with a broader website vulnerability scanner check for leftover admin paths. Related reading How to scan a website for vulnerabilities — a practical order of checks after a plugin patch. OWASP Top 10 explained (2025) — where broken access control and sensitive data exposure sit for site owners. WordPress Vulnerability Scanner — WordPress-focused public checks and next steps. Sources BleepingComputer — Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin (Bill Toulas, 19 June 2026) NVD — CVE-2026-4020 (Wordfence CNA record; last updated 17 June 2026)