CVE-2026-4020

The Gravity SMTP plugin for WordPress presents a significant vulnerability due to its REST API endpoint, which is improperly secured. This endpoint, located at /wp-json/gravitysmtp/v1/tests/mock-data, is designed to provide diagnostic information but lacks adequate authentication controls. The permission callback for this endpoint is set to always return true, allowing any unauthenticated user to access sensitive information. When the query parameter ?page=gravitysmtp-settings is appended, it triggers the register_connector_data() method, which populates the endpoint with internal connector data. This results in the exposure of approximately 365 KB of JSON data that includes critical system configuration details such as PHP version, web server version, active plugins, and even API keys or tokens configured within the plugin.

The attack vectors associated with this vulnerability are straightforward yet highly effective. An attacker could exploit this weakness by crafting a simple HTTP GET request to the vulnerable endpoint, appending the necessary query parameter to retrieve sensitive system information. Given that the endpoint is accessible without authentication, even individuals with minimal technical knowledge can execute this attack. Once an attacker gains access to the system report, they can gather intelligence about the underlying infrastructure, potentially leading to further exploitation. For instance, knowledge of the PHP version and loaded extensions could allow an attacker to identify known vulnerabilities in those components, facilitating a more targeted attack.

The real-world impact of this vulnerability is substantial, particularly for organizations that rely on WordPress for their web presence. The exposure of sensitive configuration data can lead to a variety of security risks, including unauthorized access to the WordPress admin panel, database breaches, and the potential for further exploitation of the server environment. Businesses may face reputational damage, financial losses, and regulatory penalties if sensitive customer data is compromised as a result of this vulnerability. The risk is exacerbated for organizations that store sensitive information or operate in regulated industries, where data protection is paramount.

To detect and mitigate this vulnerability, organizations should first conduct a thorough assessment of their WordPress installations, specifically focusing on the Gravity SMTP plugin. Regular vulnerability scans and penetration testing can help identify exposed endpoints and assess the security posture of the application. Additionally, organizations should implement strict access controls and authentication mechanisms for all API endpoints, ensuring that sensitive data is only accessible to authorized users. Updating the Gravity SMTP plugin to the latest version, where this vulnerability has been addressed, is crucial. Furthermore, employing web application firewalls (WAFs) can provide an additional layer of security by filtering out malicious requests targeting the exposed endpoint.

In conclusion, the vulnerability within the Gravity SMTP plugin underscores the importance of robust security practices in web application development and maintenance. By understanding the technical details, potential attack vectors, and real-world implications, organizations can better prepare themselves against such threats. Proactive detection and mitigation strategies are essential to safeguard sensitive information and maintain the integrity of their web applications. As the landscape of cybersecurity continues to evolve, staying informed and vigilant against emerging vulnerabilities remains a critical component of any comprehensive security strategy.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2026-4020, with a notable surge in telemetry indicating increased probing and potential exploitation attempts targeting the Gravity SMTP plugin’s vulnerable REST API endpoint. This uptick reflects growing adversary interest in leveraging the permission misconfiguration to access sensitive connector data without authentication. Although no new exploit code has been publicly disclosed, the elevated EPSS score and the sharp rise in detection events underscore an increased likelihood of exploitation in the wild. For defenders, this shift signals a heightened risk environment where opportunistic attackers may attempt to extract sensitive information or use the exposed endpoint as a foothold for further compromise. Consequently, the threat level for affected RocketGenius Gravity SMTP deployments has escalated to high, reinforcing the urgency for vigilant monitoring and rapid response to suspicious activity associated with this vulnerability.

Update 2 — June 13, 2026

CSURFACE threat intelligence has identified a marked increase in the Exploit Prediction Scoring System (EPSS) score for CVE-2026-4020, reflecting a more than twofold rise in the likelihood of exploitation. This upward adjustment occurs despite a concurrent significant reduction in detection activity across our telemetry, suggesting that while active exploitation attempts may be less frequently observed, the underlying risk of exploitation is intensifying. The EPSS score now places this vulnerability near the top percentile of predicted exploitability, underscoring its growing attractiveness to threat actors. This divergence between detection trends and predictive scoring may indicate emerging stealth tactics or shifts in attacker behavior that reduce overt detection but do not diminish the threat. For defenders, this evolving landscape signals an elevated risk posture requiring heightened vigilance, as the vulnerability’s exposure remains unmitigated and the potential for sensitive information leakage persists. The threat level for RocketGenius Gravity SMTP deployments should be considered elevated to high, reflecting the increased probability of exploitation despite the current lull in observable attack activity.

Update 3 — June 21, 2026

CSURFACE threat intelligence has detected a marked escalation in attempts to leverage the Gravity SMTP plugin vulnerability, reflected by a sharp increase in detection activity across our sensors. This surge contrasts with a concurrent decline in the EPSS score, suggesting that while exploit attempts are becoming more frequent and visible, automated exploit kits or widespread scanning campaigns may be less prevalent or less effective. The divergence between rising detection events and falling predictive exploitability underscores a potential shift in attacker tactics, possibly favoring targeted or stealthier approaches rather than mass exploitation. For defenders, this development signals an elevated risk environment where the vulnerability remains actively probed and exploited in the wild, increasing the likelihood of sensitive information exposure in affected WordPress deployments. Consequently, the threat level associated with CVE-2026-4020 should be reassessed as high, reflecting both the intensifying adversary interest and the persistent absence of effective mitigation in many environments.