Essential Insights
- Attackers can unauthenticatedly extract sensitive configuration data, API keys, and system details via a REST API endpoint in the Gravity SMTP plugin, enabling further exploitation.
- Exploited vulnerability has led to over 17 million HTTP GET requests, with threat actors potentially using exposed credentials to send unauthorized emails and compromise site security.
- Immediate update to version 2.1.5 of Gravity SMTP and credential rotation are critical to prevent ongoing data leaks and unauthorized access, especially for sites with third-party email integrations.
Threat, Attack Techniques, and Targets
Threat actors are exploiting a security flaw in the Gravity SMTP plugin for WordPress. This plugin is used on around 100,000 websites. The vulnerability is identified as CVE-2026-4020 and has a medium severity score of 5.3. Attackers use unauthenticated requests to access a specific API endpoint. By doing this, they can reveal sensitive data. This includes API keys, secrets, and OAuth tokens used for email services. The attack involves adding a query parameter “?page=gravitysmtp-settings” to the API URL. When this is done, the plugin’s settings are exposed. The exposed data covers system details, installed plugins, site configuration, and email authentication credentials. The attackers’ goal is to collect information they can use for further attacks, such as hijacking email services or discovering more vulnerabilities.
Impact, Security Implications, and Remediation
The main impact of this flaw is data disclosure. Attackers can access detailed site and system information. More importantly, they can retrieve active API keys for third-party email services like Amazon SES, Google, and Zoho. This exposure can lead to abuse of email services or unauthorized site access. The widespread exploitation is reflected in over 17 million blocked attempts since the vulnerability was discovered. The risk is high for sites that have not updated the plugin or reconfigured their credentials. Immediate action should be to update the plugin to version 2.1.5 or later. Site owners should also change API keys and secrets used in the plugin. They should review server logs for suspicious activity from IP addresses linked to the attacks. Since no detailed remediation guidance is provided in the information, site owners should consult the official vendor or security authorities for further steps.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
