Threat actors are actively exploiting a critical security flaw in the widely used Gravity SMTP WordPress plugin to extract sensitive configuration data, including API keys and authentication tokens.
The vulnerability, tracked as CVE-2026-4020 with a CVSS score of 5.3, affects all versions up to and including 2.1.4 and exposes more than 100,000 websites to potential compromise.
WordPress SMTP Plugin Flaw
The issue stems from an improperly secured REST API endpoint, “/wp-json/gravitysmtp/v1/tests/mock-data,” which lacks authentication checks because its permission_callback always returns true.
This misconfiguration allows unauthenticated attackers to invoke the endpoint and retrieve a comprehensive system report by appending the query parameter “?page=gravitysmtp-settings.”
The response contains approximately 365 KB of JSON data, including sensitive environment details such as PHP version, active plugins, database configuration, and, most critically, API credentials for third-party email services.
Wordfence revealed that the exposed data may include OAuth tokens and API keys for services such as Amazon SES, Google, Mailjet, Zoho, and Resend.
This enables attackers to hijack email functionality, impersonate legitimate domains, or pivot further into targeted attacks using reconnaissance data. The vulnerability was responsibly disclosed on March 30, 2026, after the vendor released a patched version, 2.1.5, on March 17, 2026.
Despite its moderate CVSS rating, exploitation has surged significantly in recent weeks. According to telemetry data, the Wordfence firewall has blocked more than 17 million attack attempts.
The most intense activity occurred between June 7 and June 11, 2026, with a peak of over 4 million blocked requests recorded on June 7 alone. The attack requires only a single unauthenticated HTTP GET request, making it trivial to exploit at scale.
A typical attack request observed in the wild targets the vulnerable endpoint with the required query string, prompting the server to return sensitive configuration data without any authentication barrier. This simplicity has contributed to widespread scanning and automated exploitation campaigns across the internet.
In response to active exploitation, Wordfence deployed firewall protections to premium users on May 5, 2026, with free users receiving coverage on June 4, 2026.
Notably, the firewall rule was introduced outside the standard disclosure workflow after researchers observed real-world attack activity escalating beyond initial severity assessments.
Indicators of Compromise (IOCs)
Below are key indicators associated with exploitation attempts:
| Type | Indicator | Description |
|---|---|---|
| URL path | /wp-json/gravitysmtp/v1/tests/mock-data | Vulnerable Gravity SMTP REST API endpoint targeted by attackers |
| URL (full) | /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings | Exploit request used to dump full System Report JSON including credentials |
| IP address | 45.148.10.95 | Source of over 642,000 blocked exploit attempts |
| IP address | 193.32.162.60 | Source of over 586,000 blocked exploit attempts |
| IP address | 176.65.148.139 | Source of over 539,000 blocked exploit attempts |
| IP address | 173.199.90.188 | Source of over 460,000 blocked exploit attempts |
| IP address | 45.148.10.120 | Source of over 410,000 blocked exploit attempts |
| IP address | 185.8.107.155 | Source of over 404,000 blocked exploit attempts |
| IP address | 185.8.106.37 | Source of over 399,000 blocked exploit attempts |
| IP address | 185.8.106.92 | Source of over 394,000 blocked exploit attempts |
| IP address | 185.8.106.145 | Source of over 387,000 blocked exploit attempts |
| IP address | 176.65.148.30 | Source of over 384,000 blocked exploit attempts |
| HTTP method | GET | Method used in exploitation of the REST API endpoint |
| User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Example User-Agent observed in exploit traffic |
| Affected plugin | Gravity SMTP (gravitysmtp) | WordPress SMTP plugin abused to exfiltrate sensitive configuration and credentials |
| Affected versions | <= 2.1.4 | Vulnerable versions exposed to unauthenticated data theft |
| Patched version | 2.1.5 | Fixed release that closes the sensitive information exposure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Additionally, defenders should monitor for suspicious requests to:
- /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings
Because the vulnerability does not modify files or inject payloads, traces of compromise may only exist in web server access logs.
Security experts strongly advise administrators to update to Gravity SMTP version 2.1.5 or later immediately. In addition, any exposed API keys, secrets, or OAuth tokens should be considered compromised and rotated without delay.
Organizations that leverage affected installations should also review logs for anomalous access patterns and restrict unauthorized API access.
This incident underscores how seemingly low-severity vulnerabilities can escalate into high-impact threats when sensitive data is exposed, particularly on widely deployed platforms like WordPress.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
