CVE-2026-4020

Published Mar 31, 2026

Last updated 3 months ago

CVSS high 7.5
API
SMTP

Overview

Description
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Source
security@wordfence.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity
HIGH

Weaknesses

security@wordfence.com
CWE-200

Social media

Hype score
Not currently trending

  1. CVE-2026-4020. 0day Intel: Attackers are actively exploiting a critical Gravity SMTP vulnerability (CVE-202

    @lyrie_ai

    11 Jul 2026

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. Gravity SMTP CVE-2026-4020 100,000 WordPress sites can leak their own secrets to anyone who asks. CVE-2026-4020 (CVSS 5.3) in the Gravity SMTP plugin lets unauthenticated attackers pull config data, API keys, secrets, and OAuth tokens. Already being exploited. "Medium

    @ElusivePrivacy

    21 Jun 2026

    65 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. A Gravity SMTP WordPress vulnerability (CVE-2026-4020) exposes API keys and config data. 17M+ exploit attempts detected. Patch to 2.1.5 immediately. For More: https://t.co/tvdxvQvths #GravitySMTP #CVE #WordPressSecurity #InfoDisclosure #EmailSecurity #Wordfence #PatchNow https:

    @redsecuretech

    21 Jun 2026

    53 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Malicious actors are actively exploiting the #CVE-2026-4020 security flaw (CVSS 5.3 score) to extract #API_keys, #OAuth_tokens, and sensitive configuration data on affected sites More here: https://t.co/pB6Kh24UKU

    @FosoTweets

    21 Jun 2026

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2026-4020: Gravity SMTP Zero-Auth Flaw Exploited on 100K WordPress Sites Active exploitation of CVE-2026-4020 targets Gravity SMTP WordPress plugin. 412 attacking IPs recorded in 5 days. Pat... #Vulnerabilities #Cybersecurity #CyberNews #InfoSec https://t.co/BuHB4sLDqh

    @ctrlaltnod

    20 Jun 2026

    67 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2026-4020: Gravity SMTP Info Disclosure Hits 100K Sites CVE-2026-4020 lets unauthenticated attackers pull 365 KB of JSON - API keys, DB details… Read more: https://t.co/NLgz6GWfbr #Cve20264020 #GravitySmtp #Wordpress #InformationDisclosure

    @Anavem_

    19 Jun 2026

    298 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).•CVE-2026-62547
  2. A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).•CVE-2026-11720
  3. OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints•CVE-2026-8037
  4. System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.•CVE-2026-50205
  5. The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.•CVE-2026-8206

References

Sources include official advisories and independent security research.