What is the CVSS score of CVE-2026-4020?

CVE-2026-4020 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-4020?

Gravity SMTP for WordPress versions 2.1.4 and below expose sensitive server configuration data-including database credentials, API keys, and plugin inventories-through an unauthenticated REST API…

Is there a public PoC exploit available for CVE-2026-4020?

Yes, a public proof-of-concept exploit is available for CVE-2026-4020. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4020?

Within 24 hours: Identify all WordPress instances running Gravity SMTP and confirm installed version via /wp-json/gravitysmtp/v1/package endpoint or plugin settings. Within 7 days: disable or restrict the /wp-json/gravitysmtp/v1/tests/mock-data endpoint via .htaccess, nginx configuration, or WAF rules blocking REST API calls to /wp-json/gravitysmtp/v1/tests/*. Within 30 days: upgrade Gravity SMTP to version 2.1.5 or later once available from the vendor; rotate all API keys, tokens, and database credentials exposed in affected systems; review access logs for unauthorized REST API queries to the mock-data endpoint.

PHP CVE-2026-4020

EUVD-2026-17277 HIGH

Information Exposure (CWE-200)

2026-03-31 Wordfence

PHP WordPress Information Disclosure Gravity Smtp Wordpress Plugin Rocketgenius

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 31, 2026 - 01:45 euvd

EUVD-2026-17277

Analysis Generated

Mar 31, 2026 - 01:45 vuln.today

CVE Published

Mar 31, 2026 - 01:24 nvd

HIGH 7.5

DescriptionCVE.org

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

AnalysisAI

Sensitive system configuration data exposure in Gravity SMTP for WordPress (all versions ≤2.1.4) allows unauthenticated remote attackers to retrieve comprehensive server information via an unsecured REST API endpoint. The /wp-json/gravitysmtp/v1/tests/mock-data endpoint lacks authentication controls, exposing ~365 KB of JSON containing PHP version, database credentials structure, WordPress configuration, plugin/theme inventories, and configured API keys/tokens. EPSS data not provided; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the attack vector is trivial (CVSS AV:N/AC:L/PR:N).

Technical ContextAI

This vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from improper access control in WordPress REST API endpoint registration. The Gravity SMTP plugin registers a diagnostic endpoint at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, bypassing WordPress's authentication framework. When invoked with the query parameter ?page=gravitysmtp-settings, the register_connector_data() method in class-config-collection-service-provider.php populates and returns the plugin's complete System Report. This report aggregates environment metadata intended for internal diagnostics but exposed through the public REST API. The affected product (CPE: cpe:2.3:a:rocketgenius:gravity_smtp:*:*:*:*:*:*:*:*) is a WordPress plugin written in PHP that manages SMTP email delivery configurations, making API credential exposure particularly critical for attackers conducting reconnaissance or lateral movement.

RemediationAI

Update Gravity SMTP to the latest patched version immediately by accessing WordPress admin dashboard → Plugins → Installed Plugins, locating Gravity SMTP, and clicking Update. The official changelog at https://docs.gravitysmtp.com/gravity-smtp-changelog/ should list fixed versions (consult post-2.1.4 releases). If automatic updates are disabled, download the latest version from the WordPress plugin repository and manually replace the /wp-content/plugins/gravitysmtp/ directory. Until patching, implement a temporary workaround by blocking external access to /wp-json/gravitysmtp/v1/tests/mock-data via web server configuration (Apache .htaccess or Nginx location blocks) or a WordPress security plugin with REST API filtering capabilities. After updating, immediately rotate any API keys or SMTP credentials that were configured in the plugin prior to patching, as they may have been exposed. Review web server access logs for requests to /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings to identify potential prior exploitation. Additional technical details available in Wordfence Threat Intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=cve.