CVE-2026-4020: 
WordPress vulnerability analysis and mitigation

CVE-2026-4020 is a Sensitive Information Exposure vulnerability in the Gravity SMTP plugin for WordPress, affecting all versions up to and including 2.1.4. The flaw stems from a REST API endpoint with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to retrieve a full system report containing sensitive configuration data. It was published on March 31, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable REST API endpoint is registered at /wp-json/gravitysmtp/v1/tests/mock-data, and its permission_callback unconditionally returns true — bypassing WordPress's standard authentication enforcement. When the query parameter ?page=gravitysmtp-settings is appended to the request, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON comprising the full System Report. The vulnerable code is located in class-config-collection-service-provider.php at lines 86 and 103 of the plugin's vendor library (GitHub Advisory, WordPress Trac).

Successful exploitation allows any unauthenticated remote attacker to retrieve a comprehensive system report containing PHP version and loaded extensions, web server version and document root path, database server type and version, WordPress version, all active plugins with their versions, active theme, WordPress configuration details, database table names, and any API keys or tokens configured in the plugin. This level of disclosure significantly aids attackers in fingerprinting the target environment, identifying additional vulnerabilities in installed software, and potentially leveraging exposed API credentials for further compromise (GitHub Advisory, Wordfence).

Exploitation requires no authentication, no user interaction, and no special privileges — a simple HTTP GET request is sufficient. The EPSS score is approximately 6.0% (per Feedly data) to 13.4% (per GitHub Advisory, 94th percentile), indicating meaningful exploitation probability. Exploitation activity has been reported in the wild, including a documented exploit campaign (Anchor Host), and the vulnerability was referenced in a LinkedIn post as a proof-of-concept indicator. A Nuclei detection template was added to ProjectDiscovery's nuclei-templates repository, and Emerging Threats published detection rules for this CVE. Check Point also published an advisory (CPAI-2026-6027). The vulnerability is not currently listed in the CISA KEV catalog based on available data (GitHub Advisory, Feedly).

1. Reconnaissance: Identify WordPress sites using the Gravity SMTP plugin (versions ≤ 2.1.4) via passive scanning tools (e.g., Shodan, Censys) or by checking /wp-content/plugins/gravitysmtp/ for plugin presence.
2. Confirm plugin presence: Send a HEAD or GET request to /wp-json/gravitysmtp/v1/tests/mock-data to verify the endpoint exists and responds.
3. Trigger data exposure: Send an unauthenticated HTTP GET request to the endpoint with the required query parameter:

   GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
   Host: <target>

4. Parse the response: The endpoint returns approximately 365 KB of JSON containing the full System Report, including PHP version, loaded extensions, web server details, document root, database info, WordPress version, all active plugins with versions, active theme, WordPress configuration, database table names, and any configured API keys/tokens.
5. Leverage gathered intelligence: Use the exposed plugin list to identify additional vulnerable components, use database table names to craft targeted attacks, and use any exposed API keys/tokens for direct service access or lateral movement (GitHub Advisory, Wordfence).

• Network: Unauthenticated HTTP GET requests to /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings from external IP addresses; large (~365 KB) JSON responses from this endpoint in web server logs.
• Logs: Web server access logs showing requests to /wp-json/gravitysmtp/v1/tests/mock-data with the page=gravitysmtp-settings query parameter, particularly from unfamiliar or automated user agents; high-frequency requests to this endpoint suggesting automated scanning.
• Network: Emerging Threats ruleset (updated 2026-05-19, v11196) includes detection signatures for this CVE that can be applied at the network perimeter (Emerging Threats).

Update the Gravity SMTP plugin to a version newer than 2.1.4, which contains a fix for the improper permission_callback implementation. As a temporary workaround, restrict access to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint at the web server or WAF level (e.g., via Nginx/Apache rules or a WAF rule blocking requests to this path). Additionally, rotate any API keys or tokens that may have been exposed via this endpoint, and audit web server access logs for prior unauthorized access. The official changelog is available at the Gravity SMTP documentation site (Gravity SMTP Changelog, GitHub Advisory).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry detailing the flaw. Check Point published advisory CPAI-2026-6027 covering this CVE. ProjectDiscovery added multiple Nuclei detection templates for automated scanning of this vulnerability, and the April 2026 Nuclei templates release blog post highlighted it. A Reddit thread in r/WordPress titled "Gravity SMTP Security Breach" emerged following disclosure, reflecting community concern. Anchor Host published a blog post documenting an active exploit campaign targeting this vulnerability (Check Point, Anchor Host, ProjectDiscovery Blog).