Critical Vulnerability in Gravity SMTP WordPress Plugin Leaks API Keys via Hacker Exploit

Key Takeaways

• Gravity SMTP plugin versions prior to 2.1.5 contain an unauthenticated REST API endpoint (/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings) that leaks a full system report and third‑party API credentials.
• The flaw (CVE‑2026‑4020, CVSS 5.3) stems from a permission_callback that unconditionally returns true, allowing any visitor to access the endpoint.
• Exposed data includes PHP version, loaded extensions, web‑server details, document root, database type/version, WordPress version, active plugins and themes, configuration details, table names, and API keys/tokens for services such as Amazon SES, Google, Mailjet, Resend, and Zoho.
• Attackers can harvest these credentials to send email on behalf of the compromised site and use the detailed system intelligence to plan further intrusions.
• Wordfence has observed > 17 million exploit attempts since early May 2026, peaking at > 4 million requests per day around June 6, 2026, originating from a set of known malicious IP addresses.
• Site administrators should immediately update Gravity SMTP to version 2.1.5 or later, rotate all exposed API credentials, and review server logs for suspicious requests from the listed IPs.

Overview of the Vulnerability
Gravity SMTP is a widely used WordPress plugin that simplifies configuring outbound email via third‑party services. Installed on roughly 100,000 sites, the plugin recently disclosed a medium‑severity information‑disclosure bug tracked as CVE‑2026‑4020 (CVSS score 5.3). The vulnerability resides in a REST API endpoint that, when accessed without authentication, returns a substantial JSON payload containing the site’s system report and any configured email‑integration secrets. Because the endpoint’s permission check erroneously allows any visitor, attackers can harvest sensitive data with a simple HTTP GET request.

Technical Details of the Flaw
The problematic route is registered at /wp-json/gravitysmtp/v1/tests/mock-data. Its permission_callback function unconditionally returns true, bypassing the usual capability checks that restrict access to authenticated administrators. When the query parameter ?page=gravitysmtp-settings is appended, the plugin’s register_connector_data() method is triggered. This method populates internal connector data and then outputs approximately 365 KB of JSON that includes the full System Report generated by WordPress, alongside the plugin’s stored configuration for email services.

Data Exposure
The leaked JSON contains a wide array of information useful to an attacker:

• Server and environment specifics – PHP version, loaded extensions, web‑server type and version, document‑root path.
• Database details – database server type (MySQL/MariaDB/etc.) and version, plus a list of all table names.
• WordPress core information – WordPress version, active theme, and a complete roster of active plugins with their version numbers.
• Configuration data – WordPress settings (e.g., site URL, home URL, debug flags) and any custom constants defined in wp-config.php.
• Third‑party API credentials – keys, secrets, and OAuth tokens for email integrations such as Amazon SES, Google Workspace, Mailjet, Resend, and Zoho Mail.

Because the endpoint does not require any authentication, an unauthenticated visitor can retrieve all of this data with a single request, effectively giving the attacker a comprehensive map of the site’s technical stack and direct access to external email‑sending capabilities.

Potential Impact
Exposure of live third‑party API credentials enables attackers to abuse the compromised site’s email services. They could send spam, phishing messages, or malware‑laden emails that appear to originate from the legitimate domain, damaging reputation and potentially leading to blacklisting. Moreover, the detailed system report dramatically reduces the reconnaissance effort required for follow‑on attacks. Knowledge of PHP extensions, server versions, and installed plugins helps threat actors identify known vulnerabilities (e.g., outdated libraries, unpatched components) and craft targeted exploits such as remote code execution, SQL injection, or privilege escalation.

Exploitation Timeline and Statistics
Wordfence’s threat intelligence shows that malicious actors began probing for this flaw at the start of May 2026. Activity remained low initially but surged dramatically around June 6, 2026, reaching a peak of over 4 million exploit attempts in a single day. To date, more than 17 million requests targeting the vulnerable endpoint have been blocked by Wordfence’s firewall. The sheer volume underscores how quickly attackers capitalize on newly disclosed, easily exploitable bugs, especially when they involve high‑value data like API keys.

IP Addresses Involved in the Attacks
The exploit traffic has been traced to a relatively small set of source IP addresses, suggesting coordinated campaigns or the use of specific botnets. The observed IPs include:

• 45.148.10.95
• 193.32.162.60
• 176.65.148.139
• 173.199.90.188
• 45.148.10.120
• 185.8.107.155
• 185.8.106.37
• 185.8.106.92
• 185.8.106.145
• 176.65.148.30

While blocking these addresses at the network level can provide immediate relief, attackers often rotate IPs or use proxy networks, making IP‑based blocking a temporary measure rather than a permanent solution.

Recommendations for Site Owners
Site administrators running any version of Gravity SMTP prior to 2.1.5 should treat the situation as a potential compromise if third‑party email integrations are configured. The recommended response includes:

1. Update Immediately – Upgrade Gravity SMTP to version 2.1.5 or newer, which contains the patched permission_callback that properly validates user capabilities.
2. Rotate Credentials – After updating, invalidate and regenerate all API keys, secrets, and OAuth tokens stored in the plugin’s settings for services like Amazon SES, Google, Mailjet, Resend, and Zoho.
3. Audit Logs – Review web‑server and WordPress access logs for requests to /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings, especially those originating from the IP addresses listed above. Look for unusual user‑agents, abnormal request frequencies, or successful responses (HTTP 200) from unauthenticated IPs.
4. Implement Additional Protections – Consider employing a web‑application firewall (WAF) with rules that block unauthorized access to unknown REST endpoints, or restrict the Gravity SMTP API routes to authenticated users only via custom code or security plugins.
5. Monitor for Abuse – Keep an eye on outbound email volumes and bounce rates; sudden spikes may indicate credential abuse. Enable logging and alerts within the email service provider’s dashboard to detect unauthorized use promptly.

Mitigation and Patching
The patch released in version 2.1.5 corrects the flawed permission_callback by adding a capability check (current_user_can('manage_options')) before allowing the endpoint to return data. This ensures that only users with administrative privileges can trigger the connector‑data dump. In addition to applying the update, administrators should verify that no other plugins or themes introduce similarly permissive REST routes. Regularly updating all components, subscribing to vendor security mailing lists, and performing periodic vulnerability scans are essential practices to reduce the attack surface.

Conclusion
The Gravity SMTP vulnerability exemplifies how a seemingly minor oversight—an insecure permission callback on a REST API endpoint—can lead to substantial data leakage, exposing both internal system details and highly sensitive third‑party credentials. The rapid exploitation observed by Wordfence highlights the efficiency with which threat actors weaponize such flaws. Prompt patching, credential rotation, and vigilant log monitoring are critical steps for site owners to mitigate risk and prevent attackers from leveraging the exposed information for further malicious activity. By treating this incident as a reminder to maintain rigorous update hygiene and to scrutinize API exposure, WordPress administrators can better safeguard their sites against similar threats in the future.