Cloud Security

Gravity SMTP CVE-2026-4020 Leaks Your Cloud Email Keys

Q: How One Plugin Endpoint Dumps Everything?

The flaw sits in a REST API route the plugin registers at /wp-json/gravitysmtp/v1/tests/mock-data . According to Wordfence's disclosure , the route's permission_callback unconditionally returns true , so no authentication is required to call it. On its own the endpoint returns mock test data. The pivot happens when an attacker appends ?page=gravitysmtp-settings : the plugin's register_connector_data() method fires, populates internal connector data, and the endpoint replies with roughly 365 KB of JSON containing the plugin's full System Report. That report is a reconnaissance gift. As The Hacker News documented , the exposed fields include PHP version, loaded extensions, web server version, the document root path, database server type and version, the WordPress version, every active plugin with its version, the active theme, WordPress configuration details, and database table names. An attacker now knows the entire stack and exactly which other vulnerabilities to chain next, before they have sent a single authenticated request.

June 20, 2026 · 7 min read · By CloudAI Security

Wordfence has blocked more than 17 million exploit attempts against a single WordPress mail plugin since early May 2026, and the number is still climbing. The target is CVE-2026-4020 in Gravity SMTP, a RocketGenius plugin running on roughly 100,000 sites. The bug is rated medium (CVSS 5.3), but the payload is anything but: an unauthenticated GET request can return a 365 KB JSON blueprint of the host and, more dangerously, the live API credentials the plugin holds for cloud email providers. For cloud and security operations teams, this is not a WordPress story. It is a SaaS-to-cloud credential exposure story, and it is a model for how a low-severity web bug becomes a cloud incident.

How One Plugin Endpoint Dumps Everything

The flaw sits in a REST API route the plugin registers at /wp-json/gravitysmtp/v1/tests/mock-data. According to Wordfence’s disclosure, the route’s permission_callback unconditionally returns true, so no authentication is required to call it. On its own the endpoint returns mock test data. The pivot happens when an attacker appends ?page=gravitysmtp-settings: the plugin’s register_connector_data() method fires, populates internal connector data, and the endpoint replies with roughly 365 KB of JSON containing the plugin’s full System Report.

That report is a reconnaissance gift. As The Hacker News documented, the exposed fields include PHP version, loaded extensions, web server version, the document root path, database server type and version, the WordPress version, every active plugin with its version, the active theme, WordPress configuration details, and database table names. An attacker now knows the entire stack and exactly which other vulnerabilities to chain next, before they have sent a single authenticated request.

Why CVSS 5.3 Misleads You

The CVSS 5.3 score reflects “information disclosure” and stops there. That label is technically accurate and operationally misleading. The disclosure is unauthenticated, remotely reachable, and trivially scriptable: the entire exploit is a single crafted GET request. CrowdSec’s VulnTracking report notes that by 1 June 2026 the bug had already shifted into “Background Noise,” with 412 distinct attacking IPs observed between 27 May and 1 June alone. Background noise means it has been added to every opportunistic scanner’s checklist.

The real impact is decided not by the score but by what the host has plugged in. When the disclosed data includes live, third-party API credentials, a “medium” information leak becomes a direct path into cloud email infrastructure. Severity ratings that ignore the value of exposed secrets systematically understate risk, and CVE-2026-4020 is a textbook example of that gap.

Stolen Email Keys Reach the Cloud

This is the section that matters for cloud teams. The credentials Gravity SMTP stores are for the services organizations use to deliver real mail at scale: Amazon SES, Google, Mailjet, Resend, and Zoho. BleepingComputer confirmed that the exposure includes API keys, secrets, and OAuth tokens for these configured integrations. An Amazon SES key lifted this way is not a throwaway; it is a metered, programmable sending identity tied to a billing account. It is the same API-keys-as-the-prize dynamic seen in the LiteLLM RCE chain, only reached through a far lower-severity door.

Exposed credential type	Attacker use case	Cloud blast radius
Amazon SES SMTP/API keys	Mass phishing and spam at sender scale	SES suspension, billing fraud, sender-reputation kill
Google / Gmail OAuth tokens	Mail send, workspace enumeration	Identity workspace pivot, drive exposure
Mailjet / Resend API keys	Transactional email impersonation	Provider ban, customer-facing trust damage
Zoho credentials	Mail and suite access	Lateral movement into Zoho business apps

Once a thief holds a working SES key, they do not need the WordPress site at all. They send mail directly from the cloud, the domain’s reputation collapses, the SES account may be throttled or suspended by AWS, and the victim organization inherits the fraud and deliverability fallout. The breach surface moved from the web tier to the cloud tier in a single GET request, and most monitoring never connects the two. It is a fresh reminder that cloud access controls still fail at the seam between SaaS tools and the cloud identities they impersonate.

Detection: What to Hunt in Logs

If you operate any WordPress asset, treat the following indicator as a priority hunt. The single most reliable IOC is a request to the vulnerable endpoint:

Path: /wp-json/gravitysmtp/v1/tests/mock-data
Query string: ?page=gravitysmtp-settings
Method: unauthenticated HTTP GET
Response signature: an unusually large JSON body (around 365 KB) returned to a client with no session cookie

Wordfence published the source IP addresses generating the most exploit volume. Add them to blocklists and, more importantly, grep historical access logs for any hit on the endpoint path above, because a successful pull leaves no trace in the application but a clean line in the web server log. The high-volume sources observed include 45.148.10.95, 45.148.10.120, 193.32.162.60, 176.65.148.139, 176.65.148.30, 173.199.90.188, 185.8.107.155, 185.8.106.37, 185.8.106.92, and 185.8.106.145. Any match against your logs on a host running Gravity SMTP below version 2.1.5 is a presumptive credential compromise.

The Remediation Playbook

Patching alone is insufficient here because the damage may already be done. Treat this as a credential incident, not a version bump. Work the following in order:

Update immediately: upgrade Gravity SMTP to version 2.1.5 or later, which removes the unauthenticated access to the endpoint.
Assume credential compromise: if the host ran a vulnerable version with any third-party email integration configured, assume the keys were pulled. This is non-negotiable.
Rotate every exposed secret: revoke and reissue keys for Amazon SES, Google, Mailjet, Resend, and Zoho from the provider console, not from inside WordPress.
Audit usage: check each provider’s sending logs and billing dashboards for anomalous volume dating back to late May 2026.
Hunt and block: search access logs for the IOC path and source IPs, then add them to your WAF and edge blocklists.
Reduce future surface: scope new API keys to least privilege and set expiration, so a future leak is bounded and self-healing.

Why Plugin Secret Sprawl Keeps Biting

The deeper lesson is structural, and it is the one senior practitioners should carry forward. Email and integration plugins occupy a quietly privileged position: administrators trust them, they connect to external services, and they are routinely handed long-lived credentials and full environment visibility. When a single misconfigured permission_callback in one of them can dump live cloud credentials, the problem is not that plugin. It is that cloud secrets are stored in application-layer configuration at all. As we noted when stolen credentials drove 31% of breaches, the asset attackers prize most is a working identity, and a misconfigured plugin is now one of the cheapest ways to harvest one.

CrowdSec’s telemetry reinforces the asymmetry: most observed victims were commerce environments (55%) and small office or home office deployments (39%), the exact segments where a single plugin often holds the keys to a small business’s entire email and cloud footprint. The durable fix is architectural: keep cloud credentials out of mutable application config, prefer short-lived tokens and scoped IAM roles over static API keys, and treat any plugin with outbound integration rights as a privileged identity that must be inventoried, monitored, and rotated like any other service account. CVE-2026-4020 will be patched and forgotten. The pattern it exposed will keep producing breaches until that separation becomes default practice.