Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Threat actors are actively exploiting a recently patched medium-severity information disclosure vulnerability in the Gravity SMTP WordPress plugin, which is installed on approximately 100,000 sites. Tracked as CVE-2026-4020 (CVSS score: 5.3), the flaw allows unauthenticated attackers to extract sensitive data, including API keys, secrets, OAuth tokens, and detailed system configuration information.

According to Wordfence, the vulnerability exists in a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, enabling any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin’s register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report.

An unauthenticated attacker can retrieve a wide range of information, including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and API keys/tokens configured in the plugin (such as Amazon SES, Google, Mailjet, Resend, and Zoho). Attackers can leverage this exposure to harvest credentials for sending email on behalf of the site and glean extensive details of the site’s software stack for follow-on attacks.

A patch for the vulnerability has been released in version 2.1.5 of the plugin. Wordfence has blocked more than 17 million exploit attempts targeting CVE-2026-4020 to date, with initial activity commencing at the start of May 2026 before spiking dramatically around June 6, 2026, reaching a high of over 4,000,000 requests a day later. The exploit efforts have originated from several IP addresses, including 45.148.10.95, 193.32.162.60, and others. Site owners running a vulnerable version of the Gravity SMTP plugin with third-party email integrations should assume compromise and rotate credentials after updating the plugin.