3 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
T1552.001Unsecured Credentials: Credentials In Files×1
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
An unauthenticated information-disclosure flaw in the Gravity SMTP plugin (all versions through 2.1.4) lets an attacker dump the configured email-connector credentials (SMTP, SendGrid, Mailgun and similar API keys), and it is being mass-exploited (GitHub Advisory GHSA-jxfc-8wcq-xxcg; daily 06-21). Stolen mail-sending credentials enable downstream phishing from a trusted domain. Update the plugin and rotate every credential stored in it.
An unauthenticated information-disclosure flaw in the Gravity SMTP plugin (all versions through 2.1.4) lets an attacker dump the configured email-connector credentials (SMTP, SendGrid, Mailgun and similar API keys), and it is being mass-exploited (GitHub Advisory GHSA-jxfc-8wcq-xxcg; daily 06-21).
CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4). A REST endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data ships with a permission_callback that unconditionally returns true; an unauthenticated request triggers the plugin's register_connector_data() routine, which returns a roughly 365 KB JSON system report containing API keys and OAuth tokens for every configured email connector (Amazon SES, Google Workspace, Mailjet, Resend, Zoho), plus WordPress/PHP versions, database configuration and the active-plugin inventory (The Next Web, 2026-06-20). The fix shipped in version 2.1.5 on 2026-03-17 (GitHub Advisory GHSA-jxfc-8wcq-xxcg), but mass exploitation began roughly two months later: defenders report on the order of 17 million blocked exploitation attempts, peaking in early June (The Next Web, 2026-06-20). WordPress is pervasive across European public-sector and government communications sites; any instance that ran a pre-2.1.5 version should be treated as having had its email-connector credentials harvested.
The vulnerability clears the § 2 bar on confirmed in-the-wild mass exploitation (vendor-blocked-request telemetry), not on a KEV/EUVD listing. Detection: web-server access logs for GET requests to /wp-json/gravitysmtp/v1/tests/mock-data (often with a ?page=gravitysmtp-settings parameter) from external IPs; a ~365 KB response body is a distinctive marker. Maps to T1190 Exploit Public-Facing Application → T1552.001 Unsecured Credentials: Credentials In Files. Remediation is two-step and the second step is the one most sites miss: upgrade to ≥ 2.1.5, then rotate every SES / Google / Mailjet / Resend / Zoho credential the plugin held, since the patch closes the leak but does not invalidate already-exfiltrated tokens.
CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4).