Hackers Exploit WordPress SMTP Plugin With 100,000+ Installs to Steal Sensitive Data

Threat actors are actively exploiting a critical security flaw in the widely used Gravity SMTP WordPress plugin to extract sensitive configuration data, including API keys and authentication tokens.

The vulnerability, tracked as CVE-2026-4020 with a CVSS score of 5.3, affects all versions up to and including 2.1.4 and exposes more than 100,000 websites to potential compromise.

WordPress SMTP Plugin Flaw

The issue stems from an improperly secured REST API endpoint, “/wp-json/gravitysmtp/v1/tests/mock-data,” which lacks authentication checks because its permission_callback always returns true.

This misconfiguration allows unauthenticated attackers to invoke the endpoint and retrieve a comprehensive system report by appending the query parameter “?page=gravitysmtp-settings.”

The response contains approximately 365 KB of JSON data, including sensitive environment details such as PHP version, active plugins, database configuration, and, most critically, API credentials for third-party email services.

Wordfence revealed that the exposed data may include OAuth tokens and API keys for services such as Amazon SES, Google, Mailjet, Zoho, and Resend.

This enables attackers to hijack email functionality, impersonate legitimate domains, or pivot further into targeted attacks using reconnaissance data. The vulnerability was responsibly disclosed on March 30, 2026, after the vendor released a patched version, 2.1.5, on March 17, 2026.

Despite its moderate CVSS rating, exploitation has surged significantly in recent weeks. According to telemetry data, the Wordfence firewall has blocked more than 17 million attack attempts.

The most intense activity occurred between June 7 and June 11, 2026, with a peak of over 4 million blocked requests recorded on June 7 alone. The attack requires only a single unauthenticated HTTP GET request, making it trivial to exploit at scale.

A typical attack request observed in the wild targets the vulnerable endpoint with the required query string, prompting the server to return sensitive configuration data without any authentication barrier. This simplicity has contributed to widespread scanning and automated exploitation campaigns across the internet.

In response to active exploitation, Wordfence deployed firewall protections to premium users on May 5, 2026, with free users receiving coverage on June 4, 2026.

Notably, the firewall rule was introduced outside the standard disclosure workflow after researchers observed real-world attack activity escalating beyond initial severity assessments.

Indicators of Compromise (IOCs)

Below are key indicators associated with exploitation attempts:

Type	Indicator	Description
URL path	/wp-json/gravitysmtp/v1/tests/mock-data	Vulnerable Gravity SMTP REST API endpoint targeted by attackers
URL (full)	/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings	Exploit request used to dump full System Report JSON including credentials
IP address	45.148.10.95	Source of over 642,000 blocked exploit attempts
IP address	193.32.162.60	Source of over 586,000 blocked exploit attempts
IP address	176.65.148.139	Source of over 539,000 blocked exploit attempts
IP address	173.199.90.188	Source of over 460,000 blocked exploit attempts
IP address	45.148.10.120	Source of over 410,000 blocked exploit attempts
IP address	185.8.107.155	Source of over 404,000 blocked exploit attempts
IP address	185.8.106.37	Source of over 399,000 blocked exploit attempts
IP address	185.8.106.92	Source of over 394,000 blocked exploit attempts
IP address	185.8.106.145	Source of over 387,000 blocked exploit attempts
IP address	176.65.148.30	Source of over 384,000 blocked exploit attempts
HTTP method	GET	Method used in exploitation of the REST API endpoint
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36	Example User-Agent observed in exploit traffic
Affected plugin	Gravity SMTP (gravitysmtp)	WordPress SMTP plugin abused to exfiltrate sensitive configuration and credentials
Affected versions	<= 2.1.4	Vulnerable versions exposed to unauthenticated data theft
Patched version	2.1.5	Fixed release that closes the sensitive information exposure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Additionally, defenders should monitor for suspicious requests to:

• /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings

Because the vulnerability does not modify files or inject payloads, traces of compromise may only exist in web server access logs.

Security experts strongly advise administrators to update to Gravity SMTP version 2.1.5 or later immediately. In addition, any exposed API keys, secrets, or OAuth tokens should be considered compromised and rotated without delay.

Organizations that leverage affected installations should also review logs for anomalous access patterns and restrict unauthorized API access.

This incident underscores how seemingly low-severity vulnerabilities can escalate into high-impact threats when sensitive data is exposed, particularly on widely deployed platforms like WordPress.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.