Gravity SMTP Flaw Under Active Exploitation, Leaks API Keys and OAuth Tokens

Attackers are hitting a freshly patched information disclosure bug in Gravity SMTP, the WordPress mailer installed on roughly 100,000 sites.

The flaw is tracked as CVE-2026-4020, rated medium severity at CVSS 5.3. Unauthenticated. No user interaction. That combination is why the modest score is misleading in practice.

What does an attacker get? Configuration data, API keys, application secrets, and OAuth tokens — anything the plugin holds in its mail-routing context. For sites wired up to transactional providers (SendGrid, Mailgun, Amazon SES, Postmark), those credentials are the prize. Steal the SES key and the WordPress site stops being the target; it becomes the launchpad.

The operational picture is straightforward. Gravity SMTP brokers outbound mail and stores provider credentials so the WordPress core mailer can hand off messages. The bug exposes a path that returns sensitive values without authentication. Scrape, parse, pivot.

Exploitation is already happening in the wild. Treat any vulnerable install as potentially compromised rather than merely vulnerable — credential theft leaves no obvious footprint in WordPress's own logs, and SMTP provider dashboards are where the evidence will actually surface.

Mitigation steps for defenders running Gravity SMTP:

• Patch immediately to the fixed release published by the vendor. Verify the version string in wp-admin rather than trusting the auto-update queue.
• Rotate every credential the plugin has touched: SMTP passwords, provider API keys, and any OAuth refresh tokens configured for Gmail or Microsoft 365 relays.
• Pull sending logs from your mail provider for the last 30 days and look for unfamiliar source IPs or volume spikes outside business hours.
• Audit WordPress for newly created admin users, unexpected plugin installs, and modified wp-config.php timestamps — standard post-incident hygiene if credentials were exposed.

A couple of caveats. The 5.3 CVSS reflects that the disclosed data is bounded by what the plugin stores, not the full database. That math changes the moment a leaked OAuth token grants access to a mailbox or a leaked SES key permits arbitrary sending under your domain's reputation. Information disclosure flaws are graded conservatively; they get used aggressively.

WordPress plugin bugs in this class follow a predictable arc. Disclosure, patch, mass scanning within 48 hours, opportunistic exploitation against the long tail of unpatched sites for months. The Gravity SMTP install base of ~100,000 is not enormous by WordPress standards, but the per-site payoff (working email credentials) is unusually high for phishing operators.

If you run this plugin, the patch is not optional. If you ran it and delayed updates, assume the keys walked and rotate them.