Hackers Exploit Unauthenticated Information Disclosure in Gravity SMTP WordPress Plugin

Hackers Exploit Info Disclosure Bug in Gravity SMTP WordPress Plugin

Overview

• A unauthenticated information disclosure vulnerability affects the Gravity SMTP WordPress plugin.
• The flaw is tracked as CVE-2026-4020 and carries a medium severity rating.
• It impacts all versions up to 2.1.4 and was addressed in version 2.1.5, released on March 17, 2026.
• Defiant’s Wordfence firewall reports active exploitation attempts, with more than 17 million blocked against protected sites.

Technical Details

• The vulnerability stems from an exposed REST API endpoint in Gravity SMTP.
• The plugin’s permission_callback for this endpoint always returns true, allowing unauthenticated GET requests to retrieve a comprehensive JSON “System Report.”
• The exposed data can include sensitive credentials and configuration details that facilitate further compromise.

What Data Could Be Exposed

• API keys, secrets, and OAuth tokens for configured email integrations.
• Credentials for third-party email services, including Amazon SES, Google, Mailjet, Resend, and Zoho.
• WordPress configuration details, such as installed plugins, themes, and software versions.
• Server and PHP environment information that can aid in tailoring attacks.
• Database configuration details, including server version and table names.

Exploitation Activity and Scope

• The vulnerability can be exploited without authentication, enabling attackers to gather extensive information about the target site.
• The exposed System Report can significantly lower the effort required to plan and execute subsequent attacks.
• Wordfence notes a spike in exploitation activity around June 7, with approximately 4 million blocked requests on that day; elevated volumes persisted in the days that followed.
• Administrative visibility into attack patterns includes a pattern of requests to specific endpoints (see Indicators of Compromise).

Indicators of Compromise

• A key indicator is requests to the endpoint: /wp-json/gravitysmtp/v1/tests/mock-data
• Logs showing query parameters such as ?page=gravitysmtp-settings alongside these requests can point to exploitation attempts.
• Security teams should correlate web server access logs with these signatures to identify compromised or targeted instances.

Patch Status and Affected Versions

• Affected: Gravity SMTP plugin versions up to 2.1.4.
• Patched: Version 2.1.5, released on March 17, 2026.
• Administrators relying on older versions should verify plugin versions and apply the latest patch to close the exposure.

Related Advisory: Avada Builder Flaw (Separate Issue)

• In addition to Gravity SMTP, a separate advisory was issued concerning a critical unauthenticated, arbitrary file-deletion vulnerability in the Avada Builder WordPress plugin.
• CVE-2026-8713 describes a path traversal flaw that could allow deletion of arbitrary files (e.g., wp-config.php) when a published Avada form saves submissions to the database.
• This issue was fixed in Avada Builder version 3.15.4.
• While no active exploitation of CVE-2026-8713 had been observed at the time, the advisory highlights the importance of prompt remediation for critical vulnerabilities.

Timeline of Notable Events

• June 7, 2026: Exploitation activity against Gravity SMTP spikes; millions of requests blocked by defenses.
• March 17, 2026: Gravity SMTP patch released to address CVE-2026-4020 (v2.1.5).
• June 2026: Ongoing reports and advisories from security teams noting active exploitation patterns and indicators of compromise.
• Avada advisory: CVE-2026-8713 advisory released around the same timeframe, with a prompt fix in version 3.15.4.

Impact and Security Implications

• The unauthenticated exposure of a live, often sensitive, system report increases risk of credential theft and targeted social engineering.
• Access to API keys and OAuth tokens compromises not only the WordPress site but also connected email services, potentially enabling impersonation or mass phishing campaigns.
• Detailed system and database information increases the likelihood of rapid, targeted follow-on attacks against vulnerable configurations and extensions.

Related Context and Contextual Notes

• The Gravity SMTP vulnerability is part of a broader landscape of WordPress plugin security concerns, underscoring the need for vigilant monitoring of plugin versions and rapid application of critical updates.
• Security firms continue to observe how exposure vectors, such as REST API endpoints with overly permissive callbacks, can become high-value targets for automated exploit campaigns.
• Administrators and security teams should maintain visibility into plugin inventory, monitor for suspicious REST API requests, and ensure that security tooling is tuned to detect indicators of compromise associated with these patterns.

Conclusion

• The Gravity SMTP information disclosure vulnerability CVE-2026-4020 represents a significant risk due to its unauthenticated access path and the breadth of potentially exposed data.
• Timely patching to version 2.1.5 is essential to mitigate exposure.
• The Avada Builder advisory further reinforces the urgency of addressing critical, unauthenticated weaknesses across WordPress plugins.
• Ongoing vigilance, including log analysis for specific endpoint activity and keeping plugin ecosystems current, remains a cornerstone of defending WordPress sites against evolving exploitation campaigns.