Gravity SMTP Flaw Under Active Exploitation, Leaks API Keys and OAuth Tokens

Key points - CVE-2026-4020 is a medium-severity information disclosure flaw in Gravity SMTP, rated CVSS 5.3. - Unauthenticated attackers can extract configuration data, API keys and OAuth tokens with no user interaction required. - Active exploitation is confirmed; credential theft leaves no obvious footprint in WordPress's own logs. - Any site that ran a vulnerable version should treat credentials as compromised and rotate them immediately. - Check your mail provider's sending logs and dashboard for unfamiliar source IPs or volume anomalies.

What is the Gravity SMTP vulnerability?

Gravity SMTP is a WordPress mailer plugin installed on roughly 100,000 sites, and attackers are already hitting a recently patched flaw in it. The bug, CVE-2026-4020, exposes a path that returns sensitive values without authentication and with no user interaction. Its CVSS score of 5.3 puts it at medium severity, but that rating doesn't reflect how the stolen data gets used downstream.

The plugin brokers outbound mail and stores provider credentials so WordPress can hand off messages. What an attacker walks away with includes configuration data, API keys and OAuth tokens: anything held in the plugin's mail-routing context. For sites wired to transactional providers like SendGrid or Amazon SES, those credentials are the actual prize. A working SES key turns the WordPress site from a target into a launchpad.

Should you worry if your CVSS score is only 5.3?

Yes. Information disclosure flaws are graded conservatively and used aggressively. The 5.3 reflects that disclosed data is bounded by what the plugin stores, not the full database. That math changes fast once a leaked OAuth token grants mailbox access or a leaked API key lets an attacker send mail under your domain's reputation. The score describes the flaw; it doesn't describe the campaign built on top of it.

This is the third WordPress plugin being actively exploited that we've covered since early June, following the Everest Forms Pro RCE reported on 5 June and the WP Maps Pro admin-account bug reported on 1 June. The pattern is consistent: disclosure, patch, mass scanning, then months of opportunistic exploitation against sites that never updated.

What should defenders do right now?

Patch first. Verify the version string in wp-admin rather than trusting the auto-update queue.

Pull sending logs from your mail provider and look for unfamiliar source IPs or volume spikes outside business hours. Credential theft won't surface in WordPress's own logs; the evidence is in your provider dashboard. Also audit WordPress for newly created admin accounts and unexpected plugin installs. That's standard post-incident hygiene when credentials may have been exposed.

Treat any vulnerable install as potentially compromised rather than merely at risk. If you delayed updates, assume the keys walked.

What to watch next

The Gravity SMTP install base of roughly 100,000 is not large by WordPress standards, but the per-site payoff for phishing operators is unusually high. Working email credentials under a legitimate domain's sending reputation are worth far more than a generic shell. Watch for abuse reports and DMARC failures as early indicators that stolen keys are being put to work.