---
schema: 1
kind: vulnerability
title: "CVE-2026-4020 — Gravity SMTP WordPress plugin: unauthenticated config-dump of email-connector credentials, mass-exploited"
headline: "CVE-2026-4020 — Gravity SMTP WordPress plugin: unauthenticated config-dump of email-connector credentials, mass-exploited"
summary: "The Gravity SMTP WordPress plugin is being mass-exploited (≈17M blocked requests) to dump configured SES / Google / Mailjet / Resend / Zoho credentials from any site running ≤ 2.1.4. CVE-2026-4020 is an unauthenticated REST endpoint that returns a full system report including API keys and OAuth tokens; the patch shipped in March but exploitation surged two months later, so a vulnerable site should treat every configured email credential as already harvested (The Next Web, 2026-06-20)."
discovered_at: "2026-06-21T04:55:00Z"
event_date: 2026-06-20
run_id: 2026-06-21-2b75e32c
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - actively-exploited
  - info-disclosure
  - pre-auth
  - patch-available
regions:
  - global
sectors:
  - public-sector
  - technology
entities: []
cves:
  - id: CVE-2026-4020
    cvss: "7.5"
    epss: null
    type: info-disclosure
    vector: zero-click
    auth: pre-auth
    status:
      - exploited
      - patch-available
sources:
  - url: "https://github.com/advisories/GHSA-jxfc-8wcq-xxcg"
    publisher: GitHub Advisory GHSA-jxfc-8wcq-xxcg
    role: primary
  - url: "https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit"
    publisher: The Next Web
    role: corroborating
closed_sources: []
evidence:
  - quote: CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4).
    publisher: ctipilot v2 brief (migrated)
verification: multi-source
sourcing_note: "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)"
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "**Patch Gravity SMTP to ≥ 2.1.5 and rotate every email-connector credential it held** (CVE-2026-4020, § 2). Upgrading closes the leak but does not invalidate tokens already harvested during mass exploitation — rotate SES / Google / Mailjet / Resend / Zoho keys and OAuth tokens for any site that ran ≤ 2.1.4. Hunt access logs for GET requests to `/wp-json/gravitysmtp/v1/tests/mock-data`."
migrated_from: briefs/2026-06-21.md
---

CVE-2026-4020 is an unauthenticated information-disclosure flaw in the Gravity SMTP WordPress plugin (all versions through 2.1.4). A REST endpoint registered at `/wp-json/gravitysmtp/v1/tests/mock-data` ships with a `permission_callback` that unconditionally returns `true`; an unauthenticated request triggers the plugin's `register_connector_data()` routine, which returns a roughly 365 KB JSON system report containing API keys and OAuth tokens for every configured email connector (Amazon SES, Google Workspace, Mailjet, Resend, Zoho), plus WordPress/PHP versions, database configuration and the active-plugin inventory ([The Next Web, 2026-06-20](https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit)). The fix shipped in version 2.1.5 on 2026-03-17 ([GitHub Advisory GHSA-jxfc-8wcq-xxcg](https://github.com/advisories/GHSA-jxfc-8wcq-xxcg)), but mass exploitation began roughly two months later: defenders report on the order of 17 million blocked exploitation attempts, peaking in early June ([The Next Web, 2026-06-20](https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit)). WordPress is pervasive across European public-sector and government communications sites; any instance that ran a pre-2.1.5 version should be treated as having had its email-connector credentials harvested.

The vulnerability clears the § 2 bar on confirmed in-the-wild mass exploitation (vendor-blocked-request telemetry), not on a KEV/EUVD listing. Detection: web-server access logs for GET requests to `/wp-json/gravitysmtp/v1/tests/mock-data` (often with a `?page=gravitysmtp-settings` parameter) from external IPs; a ~365 KB response body is a distinctive marker. Maps to [T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/) → [T1552.001 Unsecured Credentials: Credentials In Files](https://attack.mitre.org/techniques/T1552/001/). Remediation is two-step and the second step is the one most sites miss: upgrade to ≥ 2.1.5, **then rotate every SES / Google / Mailjet / Resend / Zoho credential the plugin held**, since the patch closes the leak but does not invalidate already-exfiltrated tokens.