Description
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Published: 2026-03-31
Score: 7.5 High
EPSS: 5.6% Low
KEV: No
Impact: Sensitive information disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a REST API endpoint in the Gravity SMTP WordPress plugin that is allowed to be called by any visitor because its permission callback always returns true. When a requester adds the query parameter ?page=gravitysmtp-settings, the plugin sends back a large JSON string containing a full system report. The data includes the PHP version, loaded extensions, web server and database details, WordPress core and plugin versions, active theme, configuration settings, database table names, and any API keys or tokens configured in the plugin. Unauthenticated attackers can therefore obtain sensitive configuration and credential information that could enable further exploitation.

Affected Systems

All WordPress sites using the Gravity SMTP plugin version 2.1.4 or earlier are affected. The plugin is distributed by RocketGenius and the flaw exists in every build up to and including the 2.1.4 release.

Risk and Exploitability

The CVSS score of 7.5 marks this issue as high severity, and though EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, the attack vector remains unauthenticated via a public REST endpoint. Because no authentication is required, an attacker can simply issue an HTTP GET request and receive privileged configuration data, making the vulnerability both easy to exploit and of significant value. Administrators should consider this a high‑risk threat until the plugin is patched.

Generated by OpenCVE AI on March 31, 2026 at 05:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Gravity SMTP plugin version (2.1.5 or newer) that removes the insecure endpoint.
  • Verify that the /wp-json/gravitysmtp/v1/tests/mock-data endpoint is no longer accessible by performing a test GET request.
  • Revoke any API keys or tokens that may have been exposed in past requests and update them if necessary.
  • If a patch is not yet available, temporarily disable the plugin or block the vulnerable endpoint using a firewall rule or security plugin configuration.
  • Monitor web server logs for repeated attempts to access the endpoint and block offending IP addresses.

Generated by OpenCVE AI on March 31, 2026 at 05:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Rocketgenius
Rocketgenius gravity Smtp
Wordpress
Wordpress wordpress
Vendors & Products Rocketgenius
Rocketgenius gravity Smtp
Wordpress
Wordpress wordpress

Thu, 02 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Description The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Title Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Rocketgenius Gravity Smtp
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:36:27.623Z

Reserved: 2026-03-11T19:55:54.999Z

Link: CVE-2026-4020

cve-icon Vulnrichment

Updated: 2026-03-31T15:30:47.296Z

cve-icon NVD

Status : Deferred

Published: 2026-03-31T02:15:59.487

Modified: 2026-04-24T18:11:16.583

Link: CVE-2026-4020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T09:10:37Z

Weaknesses