CVE-2026-4020 in Gravity SMTP Plugin
Summary
by MITRE • 03/31/2026
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/31/2026
The Gravity SMTP plugin for WordPress presents a critical sensitive information exposure vulnerability that affects all versions up to and including 2.1.4. This flaw resides within the plugin's REST API implementation and represents a significant security risk that aligns with CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability manifests through an improperly secured REST API endpoint located at /wp-json/gravitysmtp/v1/tests/mock-data which lacks proper authentication checks. The permission_callback function returns true unconditionally, eliminating any access controls that would normally prevent unauthorized users from accessing sensitive data. This design flaw creates an attack surface that directly violates security best practices and allows any unauthenticated visitor to exploit the vulnerability.
The technical exploitation of this vulnerability occurs when attackers append the ?page=gravitysmtp-settings query parameter to the vulnerable endpoint. This parameter triggers the plugin's register_connector_data() method which populates internal connector data and returns approximately 365 KB of structured JSON data containing comprehensive system information. The returned data encompasses a detailed system report that includes fundamental system configuration details such as PHP version, loaded extensions, web server version, and document root path. Additionally, the endpoint reveals critical infrastructure information including database server type and version, WordPress version, all active plugins with their respective versions, active theme details, WordPress configuration settings, database table names, and any API keys or tokens that may be configured within the plugin itself.
The operational impact of this vulnerability extends beyond simple information disclosure and represents a substantial risk to system security and privacy. Attackers can leverage this exposure to gather comprehensive intelligence about the target environment, enabling more sophisticated attacks such as privilege escalation, lateral movement, or targeted exploitation of known vulnerabilities in specific software versions. The exposure of database table names and WordPress configuration details provides attackers with valuable reconnaissance data that can be used to plan further attacks against the system. The inclusion of API keys and tokens within the returned data creates additional risk as these credentials could potentially be used to access external services or perform unauthorized actions within the compromised environment. This vulnerability directly maps to ATT&CK technique T1213 - Data from Information Repositories, where adversaries collect sensitive data from system information repositories, and T1082 - System Information Discovery, which involves gathering detailed information about the target system.
The recommended mitigations for this vulnerability include immediate patching of the Gravity SMTP plugin to a version that properly implements authentication checks for the affected REST API endpoint. System administrators should ensure that all WordPress plugins are kept up to date with the latest security releases and that proper access controls are implemented for all REST API endpoints. Network-level protections such as firewall rules and rate limiting can help reduce the impact of potential exploitation attempts, while monitoring solutions should be implemented to detect unusual access patterns to REST API endpoints. Additionally, security teams should conduct regular vulnerability assessments of their WordPress installations to identify and remediate similar issues in other plugins or themes. The vulnerability demonstrates the critical importance of implementing proper authentication and authorization controls for all API endpoints, particularly those that return system-level information, and underscores the necessity of following secure coding practices that prevent unauthorized access to sensitive data through API interfaces.