Security Alert CVE-2026-4020 exposes mail credentials at Gravity SMTP and affects 100,000 WordPress sites

A recently parked vulnerability in the Gravity SMTP plugin for WordPress - identified as CVE-2026-4020- has exposed sensitive credentials and configurations in approximately 100,000 sites, and the attackers have not taken long to take advantage of it massively. The problem lies in an endpoint of the REST API that returned a complete system report when it was invoked with a specific parameter, without any permit verification, which allowed any unauthenticated visitor to download JSON with installation details and third party keys.

The real risk goes beyond a simple leak: the exposed keys and tokens of mail services (Amazon SES, Google, Mailjet, Resend, Zoho, etc.) allow an attacker to send emails on behalf of the affected domain, impacting reputation, deliverability and user confidence. In addition, the filtered system report includes PHP versions, loaded extensions, active plugins and database table names, information that facilitates more targeted later attacks, from old versions to climbing within the server.

Public data from the attempt block show a broad and sustained campaign: security platforms have reported millions of requests against this endpoint in recent days, which means that the risk window was quickly taken advantage of. If your site used mail integrations on Gravity SMTP, it is prudent to make a commitment until proven otherwise and act accordingly.

The immediate actions necessary are to update the plugin to the corrected version (2.1.5 or higher) and, critically, to rotate or revoke all third party credentials and tokens that were configured in the plugin. It is not enough to update: filtered credentials can remain in the hands of attackers who have already downloaded them. Also contact mail providers to request revocation and issuance of new keys with minimum permissions.

In addition to changing keys, check the server and site records for requests to the affected endpoint and unusual activity in times or volumes of outgoing mail; pay special attention to requests from IP addresses that have been associated with the operating campaign. If you find signs of abuse, isolate the compromised system, change WordPress administrative passwords and review the creation of unauthorized users or scheduled tasks.

To reduce future risk, it is appropriate to apply tightening measures: restrict access to the REST API only when necessary or add permission checks to endpoints custom, store credentials with minimum scope and outside the site database where possible, and protect mail management with per- site credentials and periodic rotation policies. A web application firewall (WAF) can block known operating patterns while applying patches, and WordPress security solutions help detect unauthorized changes.

From a supplier perspective, the integrations using third-party keys should be designed to minimize impact in case of leakage: tokens with limited scopes, short decidencies, detailed logging and atypical alerts on the supplier panel. If you manage multiple sites, centralize the management of secrets with dedicated tools and enable multifactor authentication in supplier accounts reduces the possibility of abuse after a leak.

If you need to check the technical nature of the failure and see official recommendations, see the CVE tab and the security documentation of the WordPress REST API. To understand how it was detected and the extent of mass exploitation, public security firms have published analyses and blockades observed during the campaign: CVE-2026-4020 in NVD and documentation of the WordPress REST API on developer.wordpress.org / rest-api. It is also recommended to review security signature reports such as Wordfence for engagement indicators and operating patterns.

In short, it acts urgently: updates the plugin, breaks the exposed credentials, reviews logs and looks for signs of abuse. Taking these measures reduces both the immediate damage and the likelihood that the filtered information will be used as a basis for greater commitments in your web infrastructure.