CVE-2026-4020
HighExploitedGravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Published Mar 31, 2026 · Updated May 13, 2026 · Also known as 12a296db-ecc0-409b-8718-0c208504053a
Key Facts
Patch immediately- CVE-2026-4020 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting gravitysmtp (wordpress-plugin), Gravity SMTP.
- It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Mar 31, 2026. No public exploit code is known.
- EPSS estimates a 2.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including gravitysmtp 2.1.5.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
2.2%
Higher than 82.5% of all scored CVEs
Exploited in the wild
Yes
2 catalog listings
Public exploit code
None known
Get the full CVE-2026-4020 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Mar 31, 2026 | n/a | Not reported |
| CIRCL KEV | Jun 17, 2026 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| gravitysmtpwordpress-plugin | See advisory | 2.1.5 |
| Gravity SMTP | See advisory | n/a |
Patched Releases
gravitysmtp
2.1.5
Timeline
Publicly disclosed
Mar 31, 2026
Added to Industry KEV feed
Mar 31, 2026
Last updated
May 13, 2026
Added to CIRCL KEV
Jun 17, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=api-scan
- exploitVulnCheck exploitation report
- otherhttps://docs.gravitysmtp.com/gravity-smtp-changelog/
- otherhttps://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L103
FAQ
Common Questions.
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4.
Affected: gravitysmtp (wordpress-plugin); Gravity SMTP. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Mar 31, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including gravitysmtp 2.1.5.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-4020 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo