vulnerability
Gravity SMTP WordPress Plugin Leaks Live Credentials
2026-06-19
A WordPress plugin called Gravity SMTP, installed on roughly 100,000 sites, spent months quietly handing out its entire system report to anyone polite enough to send a GET request. No login, no token, no friction. Just ask.
The flaw, tracked as CVE-2026-4020, affects every version up to and including 2.1.4. It was patched in 2.1.5 on 17 March. If you are still running an earlier version, the bad news has probably already found you.
How it broke
The problem is almost embarrassingly simple. A REST API endpoint inside the plugin had its permission check hardwired to return true. That single line of code turned an internal diagnostic into a public buffet. Anyone hitting the endpoint received a tidy JSON bundle describing the site's inner workings, including live credentials for whichever third-party email service the site was using to send mail.
With those credentials in hand, an attacker can send mail straight from the victim's infrastructure, which is exactly the sort of trust signal that makes phishing land. The rest of the system report doubles as a map for finding further weak spots: versions, paths, configurations, the lot.
Exploitation is already loud
Defiant, the company behind the Wordfence firewall, says attackers are well into this one. It has blocked more than 17 million attempts against protected sites, with a clear spike on 7 June when four million requests landed in a single day. Activity stayed elevated for days afterwards, which is the usual pattern once a working exploit goes around.
Administrators can check web server logs for requests to:
- /wp-json/gravitysmtp/v1/tests/mock-data
- Anything carrying the ?page=gravitysmtp-settings parameter
That combination is the calling card. If it shows up in your logs and you were running a vulnerable version, assume the SMTP credentials are gone and rotate them today, not next sprint.
And while you're in there
The same week, Defiant flagged a separate critical bug in the Avada Builder plugin, CVE-2026-8713, a file-deletion flaw patched in version 3.15.4. Avada Builder sits on around a million sites, which is a generous target surface for whoever decides to weaponise it next.
None of this is exotic. There is no nation-state, no zero-click, no clever chain of bugs. A developer set a permission check to true and forgot, and a different developer left a file path unchecked, and the rest is just opportunism scaling up.
The boring discipline of patching plugins on the day fixes drop is the entire story here. It is also, depressingly often, the difference between reading these write-ups and appearing in one.