Gravity SMTP REST API Flaw Exploited to Expose Sensitive WordPress System Reports
Active Exploitation · 2 sources · Updated 14d ago · First seen May 27, 2026
Attackers are exploiting CVE-2026-4020, an unauthenticated information disclosure vulnerability in RocketGenius’s Gravity SMTP WordPress plugin through version 2.1.4. An ineffective permission check on a REST API endpoint exposes detailed system reports containing infrastructure information, plugin configurations, and potentially API keys or tokens. Patchstack listed the sensitive-information exposure vulnerability on March 31, 2026; CrowdSec first observed exploitation on May 27 and recorded 412 distinct attacking IP addresses through June 1.
CrowdSec classified the observed activity as routine, automated “Background Noise,” with commerce and small office/home office environments accounting for most victim activity and infrastructure takeover identified as the leading attacker objective. Organizations should upgrade Gravity SMTP to version 2.1.5 or later, review access logs for suspicious requests to system-report endpoints, and assess whether exposed reports contained credentials requiring rotation. The reported exposure does not by itself establish that attackers successfully took over affected infrastructure.
