Threat actors are exploiting a vulnerability in the Gravity SMTP WordPress plugin to steal system details and API credentials. Over 17 million exploit attempts have been blocked to date by Defiant, a WordPress security firm.

The vulnerability, tracked as CVE-2026-4020, has been exploited since early May. All versions of the Gravity SMTP plugin before version 2.1.5 are affected. Defiant warns that attackers can steal complete system details from vulnerable installations.

The issue stems from a REST API endpoint that unconditionally returns true, allowing access by any unauthenticated user. If a specific parameter is added to a query, the endpoint provides internal connector data in JSON format. This data includes a full system report with details such as PHP and WordPress versions, loaded extensions, web server details, database information, active plugins and themes, WordPress configuration details, and configured API keys or tokens.

The bug exists because the affected REST API endpoint lacks authentication or capability checks. Attackers have been sending unauthenticated GET requests to this endpoint to retrieve the comprehensive System Report JSON object. Defiant observed a surge in these attacks in June, with exploitation activity spiking on June 7; 4 million requests were blocked on that day.

Wordfence researchers stated, "The exposure of live third-party API credentials means an attacker could abuse the site's connected email services, while the detailed system report lowers the effort required to plan further attacks against the site." The vulnerability has a CVSS score of 5.3.

Gravity SMTP is an email deliverability plugin for WordPress, active on 100,000 sites, and integrates with multiple SMTP providers and API-based services. Version 2.1.5 of the plugin, which patches the vulnerability, was released on March 17. Defiant advises site owners to update Gravity SMTP deployments to version 2.1.5 and check server access logs for requests to the affected endpoint, specifically looking for '/wp-json/gravitysmtp/v1/tests/mock-data' with the '?page=gravitysmtp-settings' query parameter.