Attackers are actively exploiting a security flaw in Gravity SMTP, a WordPress plugin installed on approximately 100,000 websites. The vulnerability allows unauthorized access to sensitive configuration data, including API keys and OAuth tokens.

The issue, designated CVE-2026-4020, received a CVSS score of 5.3. This medium-severity information disclosure flaw enables unauthenticated attackers to extract critical data from affected sites. The vulnerability stems from a REST API endpoint that fails to properly validate user permissions.

How the Gravity SMTP Vulnerability Works

According to Wordfence, the flaw exists in a REST API endpoint located at /wp-json/gravitysmtp/v1/tests/mock-data. The endpoint uses a permission callback that always returns true. Therefore, any unadhenticated visitor can access protected information without logging in.

When attackers append the query parameter “?page=gravitysmtp-settings” to requests, the plugin’s register_connector_data() method activates. This method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON data. The response includes the complete system report with sensitive configuration details.

Exposed Information Includes Critical Data

An unauthenticated attacker exploiting this vulnerability can retrieve extensive information about targeted websites. The exposed data includes PHP version details, loaded extensions, and web server versions. Additionally, attackers gain access to document root paths and database server information.

The vulnerability reveals WordPress version information and lists all active plugins with their version numbers. It also exposes the active theme, WordPress configuration settings, and database table names. Most critically, the flaw discloses API keys and tokens for multiple email services.

Compromised credentials include access tokens for Amazon SES, Google, Mailjet, Resend, and Zoho. Attackers can use these credentials to send unauthorized emails on behalf of affected sites. Furthermore, the detailed system information helps attackers plan additional targeted attacks.

Widespread Exploitation Campaign Underway

Security researchers have observed active exploitation of CVE-2026-4020 in the wild. Bad actors send unauthenticated HTTP GET requests to the vulnerable REST API endpoint. These requests include the specific query parameter that triggers data exposure.

Wordfence reports blocking over 17 million exploit attempts targeting this vulnerability to date. Initial attack activity began in early May 2026. However, exploitation attempts increased dramatically around June 6, 2026.

Attack volume peaked on June 7, 2026, reaching over 4 million requests in a single day. This spike indicates coordinated exploitation efforts by multiple threat actors. The attacks originated from several IP addresses across different networks.

Known Malicious IP Addresses

Security analysts have identified specific IP addresses associated with exploitation attempts. These include 45.148.10.95, 193.32.162.60, and 176.65.148.139. Additional attacking addresses are 173.199.90.188, 45.148.10.120, and 185.8.107.155.

Other confirmed malicious sources include 185.8.106.37, 185.8.106.92, and 185.8.106.145. The list also contains 176.65.148.30. Website administrators should review server logs for requests from these addresses.

Immediate Actions Required for Site Owners

The Gravity SMTP development team released version 2.1.5 to address this security flaw. Site owners must update to this patched version immediately. However, updating alone may not be sufficient if credentials were already compromised.

Website administrators running vulnerable versions with configured third-party email integrations should assume potential compromise. After updating the plugin, they must rotate all credentials for connected email services. This includes API keys and OAuth tokens for all integrated platforms.

Additionally, administrators should examine server log files for suspicious activity. Look for requests to the vulnerable API endpoint originating from the identified malicious IP addresses. Check logs for unusual patterns or unauthorized access attempts during the exploitation period.

Understanding the Security Impact

Wordfence emphasizes that the impact of sensitive information exposure depends on what data becomes accessible. In this case, live third-party API credentials exposure creates significant risk. Attackers can abuse connected email services to send spam or phishing campaigns.

The detailed system report substantially reduces the effort required for planning additional attacks. Knowing specific software versions and configurations helps attackers identify other potential vulnerabilities. This information enables more targeted and effective subsequent attack campaigns.

The vulnerability demonstrates the importance of proper authentication controls in REST API endpoints. Permission callbacks must validate user credentials rather than unconditionally granting access. This incident highlights how seemingly minor coding oversights can create serious security exposures.

Best Practices for WordPress Security

This incident reinforces several critical WordPress security practices. First, maintain all plugins at their latest versions. Security patches often address actively exploited vulnerabilities. Delayed updates leave sites exposed to known attack methods.

Second, regularly audit installed plugins for security announcements. Monitor official security advisories from WordPress and plugin developers. Subscribe to security feeds from reputable sources like Wordfence.

Third, implement defense-in-depth strategies beyond just updating software. Use web application firewalls to block malicious requests. Employ intrusion detection systems to identify unusual activity patterns. Consider rate limiting for API endpoints to prevent automated exploitation attempts.

Finally, develop and test an incident response plan. Know what steps to take when a vulnerability affects your site. Have procedures ready for credential rotation and compromise assessment. Quick response times minimize the impact of security incidents.

Original Source: thehackernews.com