CVE-2026-4020 — Gravity SMTP WordPress plugin: unauthenticated config-dump of email-connector credentials, mass-exploited
CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4). A REST endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data ships with a permission_callback that unconditionally returns true; an unauthenticated request triggers the plugin's register_connector_data() routine, which returns a roughly 365 KB JSON system report containing API keys and OAuth tokens for every configured email connector (Amazon SES, Google Workspace, Mailjet, Resend, Zoho), plus WordPress/PHP versions, database configuration and the active-plugin inventory (The Next Web, 2026-06-20). The fix shipped in version 2.1.5 on 2026-03-17 (GitHub Advisory GHSA-jxfc-8wcq-xxcg), but mass exploitation began roughly two months later: defenders report on the order of 17 million blocked exploitation attempts, peaking in early June (The Next Web, 2026-06-20). WordPress is pervasive across European public-sector and government communications sites; any instance that ran a pre-2.1.5 version should be treated as having had its email-connector credentials harvested.
The vulnerability clears the § 2 bar on confirmed in-the-wild mass exploitation (vendor-blocked-request telemetry), not on a KEV/EUVD listing. Detection: web-server access logs for GET requests to /wp-json/gravitysmtp/v1/tests/mock-data (often with a ?page=gravitysmtp-settings parameter) from external IPs; a ~365 KB response body is a distinctive marker. Maps to T1190 Exploit Public-Facing Application → T1552.001 Unsecured Credentials: Credentials In Files. Remediation is two-step and the second step is the one most sites miss: upgrade to ≥ 2.1.5, then rotate every SES / Google / Mailjet / Resend / Zoho credential the plugin held, since the patch closes the leak but does not invalidate already-exfiltrated tokens.
CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4).
Defender actions
- Patch Gravity SMTP to ≥ 2.1.5 and rotate every email-connector credential it held (CVE-2026-4020, § 2). Upgrading closes the leak but does not invalidate tokens already harvested during mass exploitation — rotate SES / Google / Mailjet / Resend / Zoho keys and OAuth tokens for any site that ran ≤ 2.1.4. Hunt access logs for GET requests to
/wp-json/gravitysmtp/v1/tests/mock-data.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Credential Access TA0006
T1552Unsecured Credentials
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.