Gravity SMTP WordPress plugin flaw exploited in attacks

WordPress site administrators are being urged to update the Gravity SMTP plugin after security researchers confirmed active exploitation of a vulnerability that exposes sensitive system and email service credentials. The flaw, tracked as CVE-2026-4020, affects all versions of the plugin up to and including 2.1.4, which is installed on approximately 100,000 sites. A patch was released on March 17, 2026, but many sites remain unprotected as attack volumes surge.

The vulnerability stems from an improperly secured REST API endpoint in Gravity SMTP. The endpoint’s permission_callback function returns true by default, allowing unauthenticated GET requests to retrieve a detailed "System Report" in JSON format. This report includes API keys, OAuth tokens, and credentials for third-party email services such as Amazon SES, Google, Mailjet, Resend, and Zoho. It also reveals WordPress configuration details, server environment information, and database structure, providing attackers with a roadmap for further compromise.

What happened

Security firm Defiant, which operates the Wordfence firewall, reported blocking over 17 million exploit attempts targeting CVE-2026-4020. Exploitation activity spiked on June 7, 2026, with 4 million requests blocked in a single day, and remained elevated for several days afterward. The most active source IP addresses have been identified and shared for blocking. A key indicator of compromise is the presence of requests to /wp-json/gravitysmtp/v1/tests/mock-data in web server access logs, particularly those containing the query parameter ?page=gravitysmtp-settings.

While the vulnerability is rated as medium severity, its impact is significant. Exposed email service credentials can be used to impersonate the victim, send phishing emails, or conduct further attacks. The detailed system report also lowers the barrier for attackers to identify and exploit additional vulnerabilities in the site’s software stack. Defiant researchers warned that the combination of live API credentials and comprehensive system data "significantly lowers the effort required to plan further attacks against the site."

Why it matters

The Gravity SMTP plugin is widely used to manage email delivery for WordPress sites, making it a high-value target for attackers. The exposed data can lead to email account takeovers, which are often used for business email compromise (BEC) scams, phishing campaigns, or spreading malware. Additionally, the server and database details included in the system report can be leveraged to craft targeted attacks, such as SQL injection or remote code execution, against vulnerable sites.

WordPress site owners are advised to update to Gravity SMTP version 2.1.5 or later immediately. Administrators should also review their email service configurations for unauthorized changes and rotate any exposed credentials. Monitoring web server logs for suspicious requests to the vulnerable endpoint can help identify compromised sites.

In a separate advisory, Defiant also warned about a critical vulnerability in the Avada Builder plugin (CVE-2026-8713), which allows unauthenticated arbitrary file deletion on sites using the plugin. While no active exploitation has been observed, the flaw could lead to full site takeover if critical files like wp-config.php are deleted. The issue was patched in version 3.15.4 of Avada Builder.