CVE-2026-4020

Confirmed PUBLISHED

Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API

RocketGenius · Gravity SMTP

Not yet in CISA KEV

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Get the Pro API

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

217

Unique Attacker IPs

112

CISA KEV

Not yet in CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

7.5 High EPSS 39.7%

At a Glance

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

wordpress php nuclei_scanner

CVE Published: Mar 31, 2026
Exploited Since: Jun 12, 2026
CVSS: 7.5 High
EPSS: 39.7%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
RocketGenius	Gravity SMTP	* to <= 2.1.4	Affected

CVE References

wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc... wordfence.com · CVE Record https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ec...
gravityforms.com/gravity-smtp gravityforms.com · CVE Record https://www.gravityforms.com/gravity-smtp/
plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityform... plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/g...
plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravit... plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/ven...
plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityform... plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/g...

Show 2 more references

plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravit... plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/ven...
docs.gravitysmtp.com/gravity-smtp-changelog docs.gravitysmtp.com · CVE Record https://docs.gravitysmtp.com/gravity-smtp-changelog/

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
KEVIntel First	2026-06-12 00:35 UTC
Wordfence	2026-06-17 10:28 UTC
The Shadowserver	2026-07-09 00:00 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 100

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4020.yaml	Jun 01, 2026

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-06-17 10:28:34 UTC · Wordfence

Active exploitation observed

Recorded 2026-06-12 00:35:27 UTC · KEVIntel sensor

Proof of concept available

Recorded 2026-06-12 14:21:13 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-4020.yaml	Jun 01, 2026

Recent Mentions

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

TheHackerNews · Jun 20, 2026

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity information disclosure flaw that can allow unauthenticated attackers to extract sensitive data, such as configuration data, API keys, secrets, and OAuth tokens

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

faizdotid/CVE-2026-4020

github · Created 2026-06-30 11:37:40 UTC · 0 stars

HORKimhab/CVE-2026-4020

github · Created 2026-06-22 04:18:06 UTC · 0 stars

CVE-2026-4020 - Draft

Gravity SMTP WordPress Plugin - Sensitive Information Exposure

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

9 Jul 2026 00:00 UTC 3 days ago

9 Jul 2026 00:00 UTC · 3 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
22 Jun 2026 14:21 UTC 19 days ago

22 Jun 2026 14:21 UTC · 19 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
17 Jun 2026 10:28 UTC 25 days ago

17 Jun 2026 10:28 UTC · 25 days ago

KEV confirmed by Wordfence

Exploitation attested by an external source
12 Jun 2026 14:21 UTC 29 days ago

12 Jun 2026 14:21 UTC · 29 days ago

Public PoC available

Public proof-of-concept code published
12 Jun 2026 00:35 UTC 30 days ago

12 Jun 2026 00:35 UTC · 30 days ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:35 UTC 30 days ago

12 Jun 2026 00:35 UTC · 30 days ago

Indicators of compromise added (112)

Indicators of compromise recorded
1 Jun 2026 15:34 UTC about 1 month ago

1 Jun 2026 15:34 UTC · about 1 month ago

Nuclei template available

Scanner coverage available
31 Mar 2026 01:24 UTC 3 months ago

31 Mar 2026 01:24 UTC · 3 months ago

CVE published

Vulnerability disclosed publicly
11 Mar 2026 19:55 UTC 4 months ago

11 Mar 2026 19:55 UTC · 4 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Get the Pro API View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-4020

{
  "cve_id": "CVE-2026-4020",
  "title": "Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via RE...",
  "affected_vendor": "RocketGenius",
  "affected_product": "Gravity SMTP",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.39704,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-4020

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 31 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API