CVE-2026-4020 is a medium-severity information disclosure vulnerability in the Gravity SMTP WordPress plugin, affecting versions prior to 2.1.5. The flaw allows unauthenticated attackers to extract sensitive data, including API keys, secrets, OAuth tokens, and system configuration details via a REST API endpoint with an insecure permission_callback.