Unpatched Gravity SMTP Plugin Leaks Credentials Across 100,000+ WordPress Sites
An unauthenticated information disclosure vulnerability in the Gravity SMTP WordPress plugin (CVE-2026-4020) allowed attackers to extract sensitive data — including API keys, email credentials, and system configurations — without requiring any login. This class of vulnerability is particularly dangerous because no user interaction or privilege escalation is needed, lowering the barrier for mass exploitation. Exposed credentials can enable follow-on attacks such as email account takeover, phishing campaigns using trusted domains, or lateral movement into connected systems. The patch was available in version 2.1.5, meaning sites running older versions remained unnecessarily exposed. Timely plugin patching and automated vulnerability scanning are critical controls for any WordPress-based infrastructure.
Tactical Insight
Immediate actions
- Upgrade Gravity SMTP to version 2.1.5 or later on all WordPress installations immediately.
- Rotate all API keys, email service credentials, and secrets that may have been exposed through the vulnerable plugin.
- Audit WordPress plugin inventories to identify any other outdated or unsupported plugins currently installed.
Long-term improvements
- Implement automated WordPress plugin update policies or a patch management tool that flags critical plugin vulnerabilities within 24 hours of disclosure.
- Maintain a centralized inventory of all third-party plugins, their versions, and associated vendor advisories across every managed WordPress site.
- Store sensitive credentials (API keys, SMTP passwords) in a dedicated secrets manager rather than directly within plugin configuration fields.
Detection measures
- Deploy a Web Application Firewall (WAF) with rules targeting unauthenticated information disclosure patterns on WordPress endpoints.
- Enable logging of all unauthenticated requests to plugin REST API endpoints and alert on anomalous enumeration activity.
- Conduct regular vulnerability scans against internet-facing WordPress assets using tools such as WPScan or a continuous attack surface management platform.