CVE-2026-4020: Gravity SMTP Plugin Information Disclosure

CVE-2026-4020 Overview

The Gravity SMTP plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 2.1.4. This security flaw allows unauthenticated attackers to access detailed system configuration data through an improperly secured REST API endpoint.

The vulnerability exists in the REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data, which has a permission_callback that unconditionally returns true. This design flaw permits any unauthenticated visitor to access the endpoint without any authorization checks. When the ?page=gravitysmtp-settings query parameter is appended to the request, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the complete System Report.

Critical Impact

Unauthenticated attackers can retrieve sensitive system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

Affected Products

• Gravity SMTP plugin for WordPress versions up to and including 2.1.4
• WordPress installations with vulnerable Gravity SMTP plugin versions
• Systems utilizing Gravity SMTP for email functionality

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-4020 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-4020

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in the flawed access control implementation within the Gravity SMTP plugin's REST API architecture. The endpoint responsible for serving test/mock data fails to implement proper authentication and authorization checks, creating an information disclosure vector that can be exploited remotely without any user interaction.

The exposed system report contains a wealth of sensitive information that attackers can leverage for reconnaissance and follow-on attacks. The detailed system configuration data—including PHP version, loaded extensions, database details, and installed plugin versions—provides attackers with valuable intelligence to craft targeted exploits against known vulnerabilities in the specific software versions running on the target system.

Root Cause

The root cause of this vulnerability is the improper implementation of the permission_callback function in the REST API route registration. The vulnerable code in the Config Collection Service Provider registers the endpoint with a callback that unconditionally returns true, effectively bypassing WordPress's built-in REST API permission system.

This architectural flaw means that any request to the endpoint—regardless of authentication status—is granted access. The secondary issue is the conditional loading of sensitive system data when specific query parameters are present, which exposes the full system report without proper authorization.

Attack Vector

The attack is network-based and requires no authentication, privileges, or user interaction. An attacker can exploit this vulnerability by simply sending an HTTP GET request to the vulnerable REST API endpoint with the appropriate query parameter.

The exploitation process involves:

1. Identifying a WordPress site running the vulnerable Gravity SMTP plugin
2. Sending a request to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint
3. Appending the ?page=gravitysmtp-settings query parameter to trigger the register_connector_data() method
4. Parsing the returned JSON response containing approximately 365 KB of sensitive system configuration data

The disclosed information can be used for further attacks, including identifying exploitable vulnerabilities in specific software versions, extracting API keys and tokens for service abuse, and mapping the internal infrastructure of the target system.

Detection Methods for CVE-2026-4020

Indicators of Compromise

• Unusual HTTP requests to /wp-json/gravitysmtp/v1/tests/mock-data endpoint in web server access logs
• Requests containing the page=gravitysmtp-settings query parameter from external IP addresses
• Large JSON responses (approximately 365 KB) from the mock-data endpoint indicating system report retrieval
• Reconnaissance patterns involving multiple requests to WordPress REST API endpoints

Detection Strategies

• Configure web application firewall (WAF) rules to alert on requests to /wp-json/gravitysmtp/v1/tests/mock-data
• Implement log analysis to detect unauthenticated requests to Gravity SMTP REST API endpoints
• Deploy intrusion detection signatures for WordPress REST API enumeration attempts
• Monitor for unusual outbound data transfers that may indicate information exfiltration

Monitoring Recommendations

• Enable detailed access logging for the WordPress REST API namespace /wp-json/gravitysmtp/
• Set up alerting for requests to sensitive plugin endpoints from non-administrative IP addresses
• Implement rate limiting on REST API endpoints to slow automated enumeration attempts
• Review access logs regularly for patterns consistent with vulnerability scanning

How to Mitigate CVE-2026-4020

Immediate Actions Required

• Update Gravity SMTP plugin to a version newer than 2.1.4 that addresses this vulnerability
• Review web server access logs to determine if the vulnerability has been exploited
• Rotate any API keys or tokens that may have been exposed through the system report
• Implement web application firewall rules to block unauthenticated access to the vulnerable endpoint

Patch Information

Users should update to the latest version of the Gravity SMTP plugin that addresses this vulnerability. The Gravity SMTP Changelog should be consulted for details on the specific version containing the fix.

For additional technical details on the vulnerability, refer to the Wordfence Vulnerability Analysis and the official Gravity Forms SMTP Plugin page for update instructions.

Workarounds

• Block unauthenticated access to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint via web server configuration or WAF rules
• Temporarily disable the Gravity SMTP plugin if updating is not immediately possible
• Implement IP-based access controls to restrict REST API access to trusted networks only
• Use a security plugin to add authentication requirements to the vulnerable endpoint

# Apache .htaccess workaround to block access to vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/gravitysmtp/v1/tests/mock-data [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Nginx configuration to block vulnerable endpoint
location ~ ^/wp-json/gravitysmtp/v1/tests/mock-data {
    deny all;
    return 403;
}