Active Exploitation of Gravity SMTP Flaw Exposes WordPress Email Credentials
Active Exploitation · 7 sources · Updated 4mo ago · First seen Jun 17, 2026
Attackers are actively exploiting CVE-2026-4020 in the RocketGenius Gravity SMTP WordPress plugin to extract sensitive configuration data and live email-service credentials from vulnerable sites. The flaw affects versions 2.1.4 and earlier and stems from an unauthenticated REST API endpoint, /wp-json/gravitysmtp/v1/tests/mock-data, whose permission check always returns true; when queried with page=gravitysmtp-settings, it can return a detailed JSON system report containing environment data, API keys, secrets, and OAuth tokens tied to providers including Amazon SES, Google, Mailjet, Resend, and Zoho.
The plugin is installed on roughly 100,000 WordPress sites, raising the risk of credential theft and abuse of legitimate outbound email infrastructure for spam, phishing, or follow-on compromise. Wordfence said it blocked more than 17 million exploitation attempts, including a spike of over 4 million in a single day, while CrowdSec observed at least 412 attacking IPs during earlier scanning and attack activity. RocketGenius released a fix in Gravity SMTP 2.1.5, and defenders are being urged to update immediately, rotate any potentially exposed credentials, and review logs for suspicious requests to the vulnerable endpoint.
