Gravity SMTP ≤ 2.1.4 — Unauthenticated Sensitive Information Exposure via REST API…

Gravity SMTP registers a REST route at /wp-json/gravitysmtp/v1/tests/mock-data whose permission_callback is hardcoded to __return_true. Any unauthenticated visitor who appends ?page=gravitysmtp-settings gets back ~365 KB of JSON: PHP version and extensions, web server, document root, DB engine/version, WordPress core version, every active plugin and theme with versions, DB table prefix, and — crucially — the API tokens and credentials configured for whatever mail transport the site uses (SendGrid, Mailgun, SES, SMTP2GO, Postmark, etc.). Affects all versions ≤ 2.1.4; fixed in 2.1.5.

Vendor's HIGH (7.5, C:H only) is technically defensible — direct CIA impact is confidentiality. In practice it understates the chain. The disclosed connector_data blob includes live transport credentials, which means this is not just recon; it's a one-shot credential leak that pivots into the victim's email infrastructure (sender reputation hijack, phishing-as-the-brand, password-reset interception). Wordfence has blocked 17M+ exploit attempts; CrowdSec flipped it to background-noise status by June 1, 2026, with 412 distinct attacker IPs and 83% of observed intent classified as infrastructure takeover. We nudge to 8.2.

Sources.

1. GitHub Security Advisory GHSA-jxfc-8wcq-xxcg
2. CrowdSec — CVE-2026-4020 Vulntracking Report
3. The Hacker News — Gravity SMTP exploit coverage
4. Atomic Edge — PoC walkthrough
5. pentest-tools.com — exploit module
6. SentinelOne Vulnerability DB
7. Managed-WP advisory (2026-03-31)
8. The Next Web — 100k WordPress sites at risk

Run this from an auditor workstation (not the target) against each WordPress host you own. Invoke as ./check-cve-2026-4020.sh https://site.example.com. No credentials needed — the test exercises the same unauthenticated path an attacker would.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-4020 (Gravity SMTP <= 2.1.4)
# Usage: ./check-cve-2026-4020.sh https://target.example.com
# Exits: 0 PATCHED | 1 VULNERABLE | 2 UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://target" >&2; exit 2
fi

UA="noisgate-check/1.0"
URL="${TARGET%/}/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings"

# 1. Probe the vulnerable endpoint.
RESP=$(curl -sk -A "$UA" -o /tmp/gsmtp_$$.json -w '%{http_code} %{size_download}' --max-time 20 "$URL") || {
  echo "UNKNOWN ($TARGET) — network error"; rm -f /tmp/gsmtp_$$.json; exit 2;
}
CODE=$(echo "$RESP" | awk '{print $1}')
SIZE=$(echo "$RESP" | awk '{print $2}')

# 2. Decide.
if [[ "$CODE" == "200" && "$SIZE" -gt 50000 ]]; then
  if grep -qE 'connector_data|system_report|gravitysmtp' /tmp/gsmtp_$$.json; then
    echo "VULNERABLE ($TARGET) — endpoint returned ${SIZE}B of System Report JSON"
    rm -f /tmp/gsmtp_$$.json; exit 1
  fi
fi

if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
  echo "PATCHED ($TARGET) — endpoint returned $CODE"
  rm -f /tmp/gsmtp_$$.json; exit 0
fi

if [[ "$CODE" == "404" ]]; then
  echo "PATCHED ($TARGET) — plugin not installed or REST route absent"
  rm -f /tmp/gsmtp_$$.json; exit 0
fi

echo "UNKNOWN ($TARGET) — HTTP $CODE, ${SIZE}B (inspect /tmp/gsmtp_$$.json manually)"
exit 2