Gravity SMTP CVE 2026 4020 security alert exposes sensitive credentials and data and is already being exploited massively

A information disclosure vulnerability in the WordPress plugin known as Gravity SMTP (registered as CVE-2026-4020) is being actively exploited and affects installations using versions prior to 2.1.5; the correction was published on 17 March. Although the official severity score is shown as a mean, the attack vector is particularly harmful because it allows non-authenticated REST calls that return a "System Report" in JSON with sensitive information without credentials.

The nature of the failure lies in an endpoint of the REST API whose permission _ callback always returns true, so any attacker can request / wp-json / gravitysmtp / v1 / tests / mock-data (often with the parameter? page = gravitysmtp-setings) and get API keys, OAuth secrets, mail services credentials like Amazon SES, Google, Mailjet, Resend or Zoho, as well as WordPress stack details, software versions, PHP / server information and database metadata. This combination turns a "information" failure into the entry door for sender supplanting, abuse of mail services and precise mapping for subsequent attacks.

Wordfence researchers have documented massive exploitation activity: their firewall has blocked more than 17 million attempts to protect customers, with a peak of approximately 4 million requests blocked on June 7. If your site uses Gravity SMTP, that volume means that it is not a theoretical threat; there are likely to have already been automated surveys against many facilities. You can read the Wordfence technical report on the campaign on your blog for more context and commitment indicators: Wordfence: attackers exploiting CVE-2026-4020.

What this implies in practice: with compromised mail credentials an attacker can send emails on behalf of the site (phishing, spam, fraud), evade reputation controls and deliver malicious loads; with system information it facilitates the identification of vulnerable versions of other plugins or WordPress itself to scale up to remote execution or take control. It is therefore appropriate to treat the escape of credentials as a high impact gap even if the initial classification is "average."

Recommended immediate action: first, update Gravity SMTP to version 2.1.5 as soon as possible in all sites it administers; the installation of the corrected version mitigates the endpoint exposure. After updating, check the web access records for requests to / wp-json / gravitysmtp / v1 / tests / mock-data and chains with ? page = gravitysmtp-settings to identify exploitation attempts and possible commitments. The official documentation of the WordPress REST API helps you understand how these endpoints are exposed: REST API - WordPress Developer Resources.

If you detect suspicious traffic or if your site was in vulnerable versions when the attacks started, assume that the mail integration credentials may be compromised and rote (revoke and reissue) all keys and tokens linked to mail services(SES, Google, Mailjet, Resend, Zoho, etc.). Check the rules for access to the APIs of those suppliers and regenerate secrets from their panels, updating the WordPress configuration only after issuing the new credentials. Also check the mail mailing logs to detect unauthorized messages and monitor mail queues and rebounds.

It is not enough to update: perform a complete security sweep on the affected sites to check file integrity, backdoors presence or management users created without authorization. If you have recent backups, keep them; in case of signs of commitment, you deepen with a forensic analysis before restoring. Activate or strengthen a web application firewall (WAF) that can block known operating patterns and consider adding rules that deny access to vulnerable endpoint until you confirm mitigation.

To reduce future risks apply preventive controls: limit access to the REST API where possible or implement authentication layers for sensitive endpoints, apply the principle of lower privilege in API accounts, enable multifactor authentication in all administrative accounts, and maintain a regular and proven process of updating and validation in a staging environment before going to production. Monitor the reputation of sending and abusing alerts in mail providers after an incident to detect account abuse.

In addition to Gravity SMTP, Wordfence has published another recent warning about critical vulnerability in Avada Builder (CVE-2026-8713) that allows arbitrary file removal by traversal in published forms; that failure was parched in the version 3.15.4 and requires an urgent update if you use Avada. Deleting files like wp-config.php can leave an unrecognisably unstable site or allow complete control, so the recommendation is the same: update and review file integrity and backup. You can consult the technical notice about that other vulnerability in the Wordfence blog: Wordfence: CVE-2026-8713 in Avada.

If you manage multiple sites, prioritize the update and review by exposure in order of criticality (sites that send transactional emails, e-commerce, and those with third-party integrations), and maintain a list of IOC (commitment indicators) - such as the mentioned REST route and the PIs identified by researchers - to block them in their firewalls. Finally, document the incident and the mediation steps to be able to respond more quickly to future automated campaigns: the attackers take advantage of slow detections and sites without patches, not theoretical gaps.