CVE-2026-4020

🗓️ 31 Mar 2026 01:24:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 16 Views🌐 WEB

Unauthenticated exposure of Gravity SMTP REST API up to version 2.1.4 via a settings endpoint leaks system report.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-4020	31 Mar 202601:24	–	attackerkb
Circl	CVE-2026-4020	31 Mar 202602:21	–	circl
CNNVD	WordPress plugin Gravity SMTP 信息泄露漏洞	31 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-4020 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API	31 Mar 202601:24	–	cvelist
EUVD	EUVD-2026-17277	31 Mar 202603:31	–	euvd
Nuclei	Gravity SMTP WordPress Plugin - Sensitive Information Exposure	3 Jun 202606:04	–	nuclei
NVD	CVE-2026-4020	31 Mar 202602:15	–	nvd
Patchstack	WordPress Gravity SMTP plugin <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API vulnerability	31 Mar 202607:02	–	patchstack
Positive Technologies	PT-2026-29181	31 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4020	1 Apr 202605:00	–	redhatcve

Vulners

Node

rocketgenius gravity_smtpRange≤2.1.4wordpress

[
  {
    "vendor": "RocketGenius",
    "product": "Gravity SMTP",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a
plugins	www.plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php
plugins	www.plugins.trac.wordpress.org/browser/gravitysmtp/trunk/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php
gravityforms	www.gravityforms.com/gravity-smtp/
plugins	www.plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php
plugins	www.plugins.trac.wordpress.org/browser/gravitysmtp/tags/2.1.4/vendor/gravityforms/gravity-tools/src/Providers/class-config-collection-service-provider.php
docs	www.docs.gravitysmtp.com/gravity-smtp-changelog/

Parameter	Position	Path	Description	CWE
page	query param	wp-json/gravitysmtp/v1/tests/mock-data	Unauthenticated access to the REST endpoint returns ~365 KB of JSON containing the full System Report when the page parameter is provided, exposing detailed system configuration data.	CWE-200

24 Apr 2026 18:11Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.12901

SSVC