6/21/2026 ·Mizael Segovia· 9 min read ·
72 views
Our team is ready to help with any questions or issues you may have.
Contact UsIf you searched for CVE-2026-4020 WordPress, the first step is to separate the noise from what matters: this is not a vulnerability in WordPress core, but a sensitive information exposure issue in the Gravity SMTP plugin. The risk appears when a WordPress site has Gravity SMTP installed in a vulnerable version, especially Gravity SMTP 2.1.4 or earlier.
The issue matters because it affects a component that often handles sensitive data: email configuration, SMTP integrations, tokens, API keys, and environment details. According to the NVD entry for CVE-2026-4020, the flaw is associated with an exposed REST endpoint that does not properly validate authentication. Wordfence classifies it as “Unauthenticated Sensitive Information Exposure via REST API” and marks it as patched.
Quick answer: if you use Gravity SMTP, update to 2.1.5 or later, review logs, and rotate SMTP credentials, tokens, and keys configured in the plugin. Updating fixes the flaw, but it does not invalidate secrets that may have been exposed beforehand.
CVE-2026-4020 is a vulnerability identifier assigned to a flaw in Gravity SMTP, a WordPress plugin. That is why many searches refer to it as “WordPress CVE 2026-4020,” even though the vulnerable component is technically not WordPress itself, but the plugin installed on the site.
This distinction matters for two reasons. First, not every WordPress site is affected: only sites using Gravity SMTP in vulnerable versions are at risk. Second, mitigation is not about reinstalling WordPress or switching CMSs, but about updating the plugin, reviewing prior exposure, and rotating credentials.
Gravity SMTP is used to manage email sending from WordPress through external providers or SMTP configurations. On many sites, this type of plugin has access to operational secrets: SMTP username, password, email service tokens, API keys, or integration information. That is why an information disclosure vulnerability can have an impact beyond the WordPress dashboard itself.
The technical description published by NVD indicates that the flaw is in a REST API endpoint exposed at:
/wp-json/gravitysmtp/v1/tests/mock-dataThe core issue is a permission_callback that returns true without checking authentication. In practice, this means that a request to the endpoint can be processed without the user being authenticated as an administrator, editor, or valid site user.
In addition, the NVD entry states that, by adding the ?page=gravitysmtp-settings parameter, the endpoint may return system information related to WordPress and the plugin. An example path to review would be:
https://tudominio.com/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settingsThe flaw, therefore, should not be understood as “someone directly accesses your dashboard,” but as a possible sensitive information leak via REST API. That information can help an attacker prepare later stages: enumerate plugins, identify versions, obtain internal paths, or reuse credentials if they were exposed.
Publicly available information identifies Gravity SMTP 2.1.4 and earlier as affected. The recommended remediation is to update to Gravity SMTP 2.1.5 or later. The official changelog shows the Gravity SMTP 2.1.5 release, and Wordfence also recommends updating to that version or later as the fix.
| Component | Status | Recommended action |
|---|---|---|
| WordPress core | Not the vulnerable component described for CVE-2026-4020 | Keep updated as a general best practice |
| Gravity SMTP 2.1.4 or earlier | Vulnerable version | Update immediately |
| Gravity SMTP 2.1.5 or later | Fixed version according to public sources | Verify installation and rotate secrets if exposure occurred |
| Sites without Gravity SMTP | Not affected by this specific CVE | Review other SMTP plugins and security alerts |
One important point: some public sources do not show a fully consistent severity score. The detailed Wordfence entry shows CVSS 5.3, while other Wordfence listings have shown 7.5. In an operational response, the exact number is less important than the real impact: if SMTP credentials or tokens were exposed, they must be treated as compromised secrets.
According to the technical description from NVD, the endpoint may return a system report with information such as WordPress version, active plugins, active theme, paths, database type, and keys or tokens configured in the plugin. Not every site will have the same level of exposure, because it depends on how Gravity SMTP is configured and which integrations are active.
This data is useful for reconnaissance. On its own it may seem less critical, but it reduces an attacker’s workload: it lets them know which stack you use, which plugins to investigate, and which paths may be relevant.
This is the most sensitive point. If an SMTP key or email token is exposed, an attacker could try to use it to send unauthorized email, impersonate transactional flows, or maintain access to external services even after the plugin has already been updated.
To answer the question “how do I know if my WordPress site is affected by CVE-2026-4020,” follow a structured diagnosis. It is not enough to check that your site “uses WordPress”; you must confirm whether Gravity SMTP is installed and which version it is running.
From the admin dashboard:
If the plugin is installed, check the version. An inactive plugin should also be handled carefully: if it is not used, the safest option is to remove it after confirming it is not part of a critical workflow.
If you see 2.1.4 or earlier, consider the site affected until proven otherwise. Update to 2.1.5 or later and document the date and time of the update.
From an external network, you can check whether the path returns content. Do this only on sites you manage or where you have authorization:
curl -i "https://tudominio.com/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings"If it returns sensitive information, act as though that data has already been seen by third parties. If it returns an error, a block, or an empty response after updating, still review logs to determine whether there were accesses before the patch.
In your web server logs, filter requests to the vulnerable path:
grep "gravitysmtp/v1/tests/mock-data" access.logIf you manage multiple sites, centralizing logs and alerts helps detect repeated patterns. At Teramont, we have already explained why bot traffic and hosting infrastructure directly influence website security and performance.
Proper mitigation combines patching, rotation, and verification. If you only update the plugin, you fix the technical cause, but you do not necessarily neutralize secrets that may have been exposed.
Before updating, create a backup of the site and database. Do not use this as an excuse to delay the patch, but avoid updating blindly on critical sites without a rollback point.
Update Gravity SMTP to 2.1.5 or later. Then confirm the version from the WordPress dashboard or your administration tools.
This step is mandatory if the site was on a vulnerable version. Change:
The practical rule is simple: any secret that may have appeared in the system report should be considered exposed. Revoke the old key, create a new one, and update the plugin configuration.
If your email provider allows API permissions to be limited, use keys with the smallest possible scope. Avoid global tokens or credentials reused across multiple sites. A dedicated token per site reduces the impact if a WordPress installation is compromised.
After rotating credentials, test forms, notifications, password recovery, and any transactional flow. Security should not break critical operations without the team noticing.
If you found accesses to the vulnerable endpoint in logs, or if you cannot rule out exposure, work from a conservative assumption: the secrets configured in Gravity SMTP may have been read.
Wordfence reported attack activity against this vulnerability, including blocked attempts in a recent period, according to its public threat intelligence for Gravity SMTP. That context justifies responding urgently, even when the site appears to be functioning normally.
No. The vulnerability is associated with the Gravity SMTP plugin. WordPress appears in searches because the plugin is installed inside WordPress sites.
Versions 2.1.4 and earlier are considered vulnerable. The recommended version is 2.1.5 or later.
Updating fixes the known flaw, but it does not revoke secrets that may have been exposed beforehand. If the site was vulnerable, you must also rotate SMTP credentials, tokens, and API keys.
It may expose system information, active plugins, active theme, paths, database type, and keys or tokens configured in the plugin, according to the technical description published by NVD.
Request the path /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings from an external network and review the response. Do this only on your own sites or with authorization.
Use this list to close your response to Gravity SMTP CVE-2026-4020 and reduce future exposure in SMTP plugins:
gravitysmtp/v1/tests/mock-data.In an incident like CVE-2026-4020 WordPress, the effective action is not just “update a plugin”: it is confirming exposure, closing the vulnerable route, invalidating potentially leaked secrets, and leaving evidence that the site has returned to a controlled state.
Find our next articles first
Mark Teramont as a preferred source to see more of our guides and news in Google, Top Stories, and its AI experiences.
Keep exploring related guides, news, and analysis.
General
Technical guide to WP2Shell in WordPress: how CVE-2026-63030 and CVE-2026-60137 work, affected versions, security patches, and compromise checks.
Read More7 min read
General
A second-order SQL injection affects All-in-One WP Migration ≤7.109. See the attack chain, real scope, update steps, and exposure checks.
Read More5 min read
General
Gravity Forms 3.0.2 and earlier allow unauthenticated arbitrary file uploads. Learn the real scope, NGINX risk and how to patch it.
Read More5 min read