Loading vulnerability…
CVE-2026-4020 is an unauthenticated sensitive information exposure vulnerability in the Gravity SMTP plugin for WordPress affecting all versions up to and including 2.1.4. The flaw is caused by a REST API endpoint that is registered with a permission callback that unconditionally returns true, allowing any remote user to access it without authentication. When the relevant settings page context is supplied in the request, the plugin's connector data registration logic populates internal data and the endpoint returns a large JSON-formatted System Report. The exposed report can include detailed WordPress, PHP, web server, and database configuration information, active plugins and theme data, document root and table metadata, and secrets configured for the plugin's email integrations, including API keys, OAuth tokens, and related credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
81 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information disclosure vulnerability in the Gravity SMTP WordPress plugin caused by an unauthenticated REST API endpoint exposing sensitive configuration and system data, including API keys and OAuth tokens.
Unauthenticated information disclosure vulnerability in the WordPress Gravity SMTP plugin that exposes API keys, OAuth tokens, mail service credentials, and detailed server configuration data via a REST API endpoint.
An unauthenticated information disclosure vulnerability in the WordPress Gravity SMTP plugin caused by an exposed REST API endpoint that allows attackers to retrieve sensitive system reports containing API keys, OAuth tokens, credentials, WordPress configuration, server information, and database configurations.
A sensitive information exposure vulnerability in the Gravity SMTP WordPress plugin that allows unauthenticated attackers to access an exposed REST API endpoint and retrieve internal connector data, including system details, configuration information, and API keys/tokens.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.