Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RocketGenius | Gravity SMTP | up to 2.1.4 | — | No fix listed | CNA |
- Gravity SMTP VendorRocketGenius Affected up to 2.1.4 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4020
- 2026-10-03 Alias added: GHSA-jxfc-8wcq-xxcg
- 2026-10-25 EPSS moved to the 99th percentile and above
- 2026-10-25 Priority changed: MEDIUM → HIGH
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=cve
- https://www.gravityforms.com/gravity-smtp/
- https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L86
- https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L86
- https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L103
- https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L103
- https://docs.gravitysmtp.com/gravity-smtp-changelog/
More RocketGenius vulnerabilities
- TI-2026-36130 WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability CVSS 3.1CRITICAL 9.6
- TI-2023-13292 WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2026-75242 PHP object injection in Gravity Forms WordPress plugin CVSS 3.1HIGH 8.1
- TI-2020-10759 common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed… CVSS 3.1HIGH 7.5
- TI-2026-03610 Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall CVSS 3.1HIGH 7.1
- TI-2020-16921 A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-4020 · CVE Program
- CVE-2026-4020 · NVD
- FIRST EPSS
- GHSA-jxfc-8wcq-xxcg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences