CVE-2026-4020 WordPress: what the Gravity SMTP vulnerability is and how to fix it

If you searched for CVE-2026-4020 WordPress, the first step is to separate the noise from what matters: this is not a vulnerability in WordPress core, but a sensitive information exposure issue in the Gravity SMTP plugin. The risk appears when a WordPress site has Gravity SMTP installed in a vulnerable version, especially Gravity SMTP 2.1.4 or earlier.

The issue matters because it affects a component that often handles sensitive data: email configuration, SMTP integrations, tokens, API keys, and environment details. According to the NVD entry for CVE-2026-4020, the flaw is associated with an exposed REST endpoint that does not properly validate authentication. Wordfence classifies it as “Unauthenticated Sensitive Information Exposure via REST API” and marks it as patched.

Quick answer: if you use Gravity SMTP, update to 2.1.5 or later, review logs, and rotate SMTP credentials, tokens, and keys configured in the plugin. Updating fixes the flaw, but it does not invalidate secrets that may have been exposed beforehand.

What CVE-2026-4020 is and why it is associated with WordPress

CVE-2026-4020 is a vulnerability identifier assigned to a flaw in Gravity SMTP, a WordPress plugin. That is why many searches refer to it as “WordPress CVE 2026-4020,” even though the vulnerable component is technically not WordPress itself, but the plugin installed on the site.

This distinction matters for two reasons. First, not every WordPress site is affected: only sites using Gravity SMTP in vulnerable versions are at risk. Second, mitigation is not about reinstalling WordPress or switching CMSs, but about updating the plugin, reviewing prior exposure, and rotating credentials.

Gravity SMTP is used to manage email sending from WordPress through external providers or SMTP configurations. On many sites, this type of plugin has access to operational secrets: SMTP username, password, email service tokens, API keys, or integration information. That is why an information disclosure vulnerability can have an impact beyond the WordPress dashboard itself.

What the Gravity SMTP vulnerability actually does

The technical description published by NVD indicates that the flaw is in a REST API endpoint exposed at:

The core issue is a permission_callback that returns true without checking authentication. In practice, this means that a request to the endpoint can be processed without the user being authenticated as an administrator, editor, or valid site user.

In addition, the NVD entry states that, by adding the ?page=gravitysmtp-settings parameter, the endpoint may return system information related to WordPress and the plugin. An example path to review would be:

The flaw, therefore, should not be understood as “someone directly accesses your dashboard,” but as a possible sensitive information leak via REST API. That information can help an attacker prepare later stages: enumerate plugins, identify versions, obtain internal paths, or reuse credentials if they were exposed.

Affected versions and fixed version

Publicly available information identifies Gravity SMTP 2.1.4 and earlier as affected. The recommended remediation is to update to Gravity SMTP 2.1.5 or later. The official changelog shows the Gravity SMTP 2.1.5 release, and Wordfence also recommends updating to that version or later as the fix.

One important point: some public sources do not show a fully consistent severity score. The detailed Wordfence entry shows CVSS 5.3, while other Wordfence listings have shown 7.5. In an operational response, the exact number is less important than the real impact: if SMTP credentials or tokens were exposed, they must be treated as compromised secrets.

What data CVE-2026-4020 can leak

According to the technical description from NVD, the endpoint may return a system report with information such as WordPress version, active plugins, active theme, paths, database type, and keys or tokens configured in the plugin. Not every site will have the same level of exposure, because it depends on how Gravity SMTP is configured and which integrations are active.

Technical site information

• WordPress version.
• Active plugins.
• Active theme.
• Internal server paths.
• Database type.

This data is useful for reconnaissance. On its own it may seem less critical, but it reduces an attacker’s workload: it lets them know which stack you use, which plugins to investigate, and which paths may be relevant.

Secrets and credentials

• API keys configured in Gravity SMTP.
• Email provider tokens.
• SMTP credentials if they are stored and included in the output.
• Integration data that could enable email-sending abuse.

This is the most sensitive point. If an SMTP key or email token is exposed, an attacker could try to use it to send unauthorized email, impersonate transactional flows, or maintain access to external services even after the plugin has already been updated.

How to know if your WordPress site is affected

To answer the question “how do I know if my WordPress site is affected by CVE-2026-4020,” follow a structured diagnosis. It is not enough to check that your site “uses WordPress”; you must confirm whether Gravity SMTP is installed and which version it is running.

1. Check whether Gravity SMTP is installed

From the admin dashboard:

1. Go to Plugins.
2. Search for Gravity SMTP.
3. Confirm whether it is active, inactive, or installed but disabled.

If the plugin is installed, check the version. An inactive plugin should also be handled carefully: if it is not used, the safest option is to remove it after confirming it is not part of a critical workflow.

2. Verify the installed version

If you see 2.1.4 or earlier, consider the site affected until proven otherwise. Update to 2.1.5 or later and document the date and time of the update.

3. Check whether the endpoint responds

From an external network, you can check whether the path returns content. Do this only on sites you manage or where you have authorization:

If it returns sensitive information, act as though that data has already been seen by third parties. If it returns an error, a block, or an empty response after updating, still review logs to determine whether there were accesses before the patch.

4. Look for indicators in logs

In your web server logs, filter requests to the vulnerable path:

If you manage multiple sites, centralizing logs and alerts helps detect repeated patterns. At Teramont, we have already explained why bot traffic and hosting infrastructure directly influence website security and performance.

How to fix CVE-2026-4020 step by step

Proper mitigation combines patching, rotation, and verification. If you only update the plugin, you fix the technical cause, but you do not necessarily neutralize secrets that may have been exposed.

1. Create a backup before touching production

Before updating, create a backup of the site and database. Do not use this as an excuse to delay the patch, but avoid updating blindly on critical sites without a rollback point.

2. Update Gravity SMTP

Update Gravity SMTP to 2.1.5 or later. Then confirm the version from the WordPress dashboard or your administration tools.

3. Rotate SMTP credentials and tokens

This step is mandatory if the site was on a vulnerable version. Change:

• SMTP passwords.
• Email provider API tokens.
• Keys for services integrated into Gravity SMTP.
• Credentials shared across environments, if any exist.

The practical rule is simple: any secret that may have appeared in the system report should be considered exposed. Revoke the old key, create a new one, and update the plugin configuration.

4. Review permissions and least privilege

If your email provider allows API permissions to be limited, use keys with the smallest possible scope. Avoid global tokens or credentials reused across multiple sites. A dedicated token per site reduces the impact if a WordPress installation is compromised.

5. Verify email sending

After rotating credentials, test forms, notifications, password recovery, and any transactional flow. Security should not break critical operations without the team noticing.

What to do if your site was exposed

If you found accesses to the vulnerable endpoint in logs, or if you cannot rule out exposure, work from a conservative assumption: the secrets configured in Gravity SMTP may have been read.

1. Update Gravity SMTP to the fixed version.
2. Revoke and recreate credentials for the SMTP or email provider.
3. Review sending activity in the provider: spikes, unusual recipients, bounces, or unauthorized campaigns.
4. Check administrator users in WordPress.
5. Audit plugins and themes to detect outdated components.
6. Review server rules, cron jobs, and recently modified files if you suspect follow-on activity.

Wordfence reported attack activity against this vulnerability, including blocked attempts in a recent period, according to its public threat intelligence for Gravity SMTP. That context justifies responding urgently, even when the site appears to be functioning normally.

Frequently asked questions about CVE-2026-4020 WordPress

Does CVE-2026-4020 affect WordPress core?

No. The vulnerability is associated with the Gravity SMTP plugin. WordPress appears in searches because the plugin is installed inside WordPress sites.

Which version of Gravity SMTP is vulnerable?

Versions 2.1.4 and earlier are considered vulnerable. The recommended version is 2.1.5 or later.

Is updating to 2.1.5 enough?

Updating fixes the known flaw, but it does not revoke secrets that may have been exposed beforehand. If the site was vulnerable, you must also rotate SMTP credentials, tokens, and API keys.

What information does the vulnerability expose?

It may expose system information, active plugins, active theme, paths, database type, and keys or tokens configured in the plugin, according to the technical description published by NVD.

How do I check whether the endpoint is exposed?

Request the path /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings from an external network and review the response. Do this only on your own sites or with authorization.

Final WordPress security checklist for SMTP plugins

Use this list to close your response to Gravity SMTP CVE-2026-4020 and reduce future exposure in SMTP plugins:

• Update Gravity SMTP to 2.1.5 or later.
• Remove SMTP plugins that are not in use.
• Rotate SMTP credentials and tokens after patching.
• Use API keys with least privilege.
• Do not reuse credentials across sites, staging, and production.
• Review logs for gravitysmtp/v1/tests/mock-data.
• Audit active plugins and installed themes.
• Enable security alerts and change monitoring.
• Maintain verified backups.
• Separate critical sites into isolated infrastructure when operational risk justifies it.

In an incident like CVE-2026-4020 WordPress, the effective action is not just “update a plugin”: it is confirming exposure, closing the vulnerable route, invalidating potentially leaked secrets, and leaving evidence that the site has returned to a controlled state.