Gravity SMTP Leak: Active Exploitation of CVE-2026-4020

Hey folks, just a heads-up that CVE-2026-4020 is seeing active exploitation in the wild. It targets the Gravity SMTP plugin (installed on ~100k sites). It's an unauthenticated information disclosure vulnerability (CVSS 5.3) allowing attackers to extract sensitive configuration data, including API keys, secrets, and OAuth tokens.

While a 5.3 score doesn't sound "critical," the impact here is asymmetric. Attackers don't need RCE; if they dump your SMTP credentials or OAuth tokens, they bypass authentication entirely on your mail providers.

For those managing large fleets, here is a quick bash one-liner to identify the plugin version across multiple sites to prioritize patching:

find /var/www -type f -wholename "*/gravity-smtp/gravity-smtp.php" -exec grep -H "Version:" {} \; | awk -F: '{print $2}'


If patching isn't immediate, blocking access to the plugin's REST endpoints is the temporary mitigation. We've seen IOCs targeting `wp-/gravity-smtp/v1/` paths.

The real pain point isn't the patch—it's the incident response. If you suspect this was hit, you have to assume every SMTP credential or OAuth token in that config is burned. How is everyone handling the credential rotation logic? Are you rotating keys proactively or waiting for confirmed logins on the mail provider side?