CVE-2026-4020

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

• CWE-200

• https://docs.gravitysmtp.com/gravity-smtp-changelog/
• https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L103
• https://plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L86
• https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L103
• https://plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php#L86
• https://www.gravityforms.com/gravity-smtp/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=cve

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40194phpseclib is a PHP secure communications library. Starting i…3.7
• CVE-2026-40195Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40196HomeBox is a home inventory and organization system. Version…8.1
• CVE-2026-40197Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40198Net::CIDR::Lite versions before 0.23 for Perl does not valid…7.5
• CVE-2026-40199Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv…6.5
• CVE-2026-40200An issue was discovered in musl libc 0.7.10 through 1.2.6. S…8.1
• CVE-2026-40201@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 al…5.4
• CVE-2026-40208An attacker might be able to delay the processing of DoH3 qu…3.7
• CVE-2026-40209An attacker might be able to cause outgoing TCP connections …5.3
• CVE-2026-4021The Contest Gallery plugin for WordPress is vulnerable to an…8.1
• CVE-2026-40210An out-of-bounds read might happen when SetMacAddrAction is …4.8