Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin to expose API keys and other sensitive data. The flaw, tracked as CVE-2026-4020, affects around 100,000 sites.
Intelligence analysis by Llama 3.3 70B
A medium-severity information disclosure flaw in the Gravity SMTP WordPress plugin is being exploited by hackers to extract sensitive data, including API keys and configuration details.
Imagine you have a secret box where you keep all your important information. The Gravity SMTP WordPress plugin vulnerability is like a hole in that box that allows bad people to look inside and take your secrets. They can use this information to send fake emails or plan other attacks against your site.
Analysis
Introduction to the Vulnerability
The Gravity SMTP WordPress plugin vulnerability, tracked as CVE-2026-4020, is a medium-severity information disclosure flaw that can allow unauthenticated attackers to extract sensitive data. The flaw is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it.
Impact of the Vulnerability
The vulnerability can be exploited by attackers to retrieve a wide range of information, including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and API keys/tokens configured in the plugin. This information can be used to plan further attacks against the site, including sending email on behalf of the site and exploiting other vulnerabilities.
Exploitation and Mitigation
Bad actors have already started exploiting the vulnerability by sending unauthenticated HTTP GET requests to the vulnerable REST API endpoint with the ?page=gravitysmtp-settings query parameter. To mitigate the vulnerability, site owners should update the plugin to the latest version, rotate the credentials, and review server log files for suspicious requests. Wordfence has blocked over 17 million exploit attempts targeting CVE-2026-4020, highlighting the need for prompt action to protect against this vulnerability.
Key points
- The Gravity SMTP WordPress plugin vulnerability is a medium-severity information disclosure flaw
- The flaw affects around 100,000 sites
- The vulnerability can be exploited to extract sensitive data, including API keys and configuration details
- Site owners should update the plugin to the latest version and rotate the credentials to mitigate the vulnerability
The patch for the vulnerability has been released, and site owners can update the plugin to protect against this flaw. By taking prompt action, site owners can prevent further exploitation and protect their sensitive data. Additionally, the widespread awareness of this vulnerability can lead to improved security practices and better protection against similar flaws in the future.
The vulnerability has already been exploited by bad actors, and the exposed API keys and other sensitive data can be used to plan further attacks. If site owners do not take prompt action to update the plugin and rotate the credentials, they may face significant consequences, including compromised email services and further attacks against their site.
