Attackers Abuse Gravity SMTP WordPress Flaw to Harvest API Keys
Security researchers have observed malicious actors exploiting a patched vulnerability in the Gravity SMTP plugin for WordPress, which is deployed on approximately 100,000 websites. Tracked as CVE-2026-4020, the flaw is classified as a medium-severity information disclosure issue that enables unauthenticated attackers to pull sensitive configuration items-ranging from API keys and secrets to OAuth tokens used by the plugin’s email integrations.
The root cause stems from a registered REST endpoint at /wp-json/gravitysmtp/v1/tests/mock-data whose permission_callback indiscriminately returns true, permitting access without authentication. Security vendor Wordfence explains that when the query parameter ?page=gravitysmtp-settings is attached, the plugin’s register_connector_data() routine fills internal connector structures, causing the endpoint to respond with roughly 365 KB of JSON that effectively contains the plugin’s full System Report.
That returned report can reveal an extensive array of details about an affected site, including the PHP version, loaded PHP extensions, web server version, document root path, database server type and version, the installed WordPress version, a list of active plugins and their versions, the active theme, WordPress configuration settings, database table names, and live API keys or tokens configured for services such as Amazon SES, Google, Mailjet, Resend, and Zoho.
Exposed credentials can be leveraged to send mail through a site’s connected third-party email providers, while the comprehensive system information lowers the bar for attackers to plan additional intrusions. As Wordfence notes, the severity of this type of leak depends on exactly what data is disclosed; in this instance, the presence of active third-party credentials and a detailed system report makes both immediate abuse and subsequent targeting far easier.
The plugin author has issued a fix in Gravity SMTP version 2.1.5. Despite the patch, threat actors have been issuing unauthenticated HTTP GET requests to the vulnerable REST endpoint with the ?page=gravitysmtp-settings parameter, triggering servers to return sensitive site information without any login required.
According to Wordfence telemetry, defenses have blocked more than 17 million attempts to exploit CVE-2026-4020 so far. Scanning and exploit activity began in early May 2026 and surged sharply around June 6, 2026, peaking at more than 4,000,000 requests on June 7, 2026. Observed source IP addresses associated with the exploitation attempts include:
- 45.148.10.95
- 193.32.162.60
- 176.65.148.139
- 173.199.90.188
- 45.148.10.120
- 185.8.107.155
- 185.8.106.37
- 185.8.106.92
- 185.8.106.145
- 176.65.148.30
Website administrators running an affected version of Gravity SMTP-especially those who have set up third-party email integrations-should treat exposed credentials as compromised: update the plugin to the patched 2.1.5 release immediately, then rotate any API keys, tokens, or passwords used by the plugin. It is also prudent to inspect server access logs for requests to the vulnerable endpoint, paying particular attention to activity originating from the IP addresses listed above.