CVE-2026-4020 HIGH

CVE-2026-4020: Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API

Vendor Rocketgenius
Product Gravity SMTP
Weakness CWE-200 · Info exposure
Published March 31, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

Explanation of Vulnerability in Simple Terms

02Summary

Gravity SMTP versions 2.1.4 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve confidential data from the plugin without needing to log in or interact with a user. Site administrators should update to a version newer than 2.1.4 to prevent unauthorized information disclosure.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the plugin without logging in.

Potential impact on your site

04Site Impact

Confidential data stored or processed by Gravity SMTP may be exposed to unauthenticated attackers.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 31, 2026 CVE published
April 8, 2026 Record updated