If your site runs the Gravity SMTP plugin at version 2.1.4 or older, you have two jobs, and both are urgent: update to 2.1.5, then replace the SMTP password and API keys configured in the plugin. The flaw tracked as CVE-2026-4020 meant that anyone, without logging in, could retrieve your site’s email sending settings — password included. Wordfence has so far blocked more than 17 million attack attempts, which means attackers are hunting for affected sites on an industrial scale. Updating on its own is therefore not enough: you should assume your details have already leaked.
What is CVE-2026-4020, and what does it reveal about your site?
Gravity SMTP is the email sending plugin from the makers of Gravity Forms: it connects your WordPress site to your email account or an email sending service, so that form messages and order confirmations reliably reach their destination. According to The Hacker News, the plugin runs on roughly 100,000 sites, and every version up to and including 2.1.4 is affected.
The flaw in plain terms: one of the plugin’s public programming interfaces (a REST API endpoint) didn’t check who was asking — so it returned the site’s full system report, roughly 365 KB of data, even without a login. According to Wordfence’s analysis, this includes the PHP and WordPress versions, all active plugins with their version numbers, database details and, most painfully, the credentials set up for sending email — the login details, API keys, secrets and OAuth tokens of connected email services (for example Amazon SES, Google, Mailjet, Zoho) (BleepingComputer).
A separate lesson is that the flaw’s official severity score (CVSS 5.3) is only medium. Clearly, attackers didn’t care: what matters isn’t the score, but what can be got out of it.
Wordfence has blocked more than 17 million exploitation attempts against CVE-2026-4020 — more than 4 million in a single day at the peak. (Source: The Hacker News)
Why isn’t updating enough? Because your password may already be out there
The 2.1.5 fix closes the door — but it doesn’t call back anyone who has already walked through it. What’s more, the fixed version was released back in March 2026, while the wave of attacks only started in early May 2026, according to The Hacker News’ report. So anyone who updated in time got away with it — but anyone who put it off for weeks had their site wide open at exactly the worst moment, with their email sending settings available to anyone who asked.
What use is an SMTP password to an attacker? It lets them send email from your domain, in your name: spam, phishing messages, fake invoices. And you bear the consequences. Your domain’s email reputation suffers, your genuine emails — quotes, order confirmations — end up in spam folders, and your email sending provider may even suspend your account. That’s why the industry advice to those affected is: assume you’ve been compromised, and replace all credentials straight after updating.
How do I know if my site is affected?
You need to answer three questions, and you don’t need to be an IT specialist for any of them:
• 1. Are you running Gravity SMTP? In your dashboard, the Plugins menu shows the list of installed plugins. If you use Gravity Forms, there’s a good chance Gravity SMTP is there alongside it. • 2. Which version? If the version number is 2.1.4 or older, your site is affected — the flaw is fixed in release 2.1.5, and every earlier version is vulnerable. • 3. Is an email account or sending service connected? If so, treat its details as leaked.
| Gravity SMTP version | Status | What should you do? |
|---|---|---|
| 2.1.4 or older | Vulnerable (CVE-2026-4020) | Update immediately, then change your SMTP password and API keys |
| 2.1.5 (March 2026) | Fixed | If you updated after May, the password and key change is still due |
| 2.1.6 or newer | Fixed | Nothing to do, as long as you replaced the credentials when you updated |
Whether any requests were actually made against your site can be traced from your hosting log files — your hosting provider or a security specialist can help with this. But it doesn’t change the bottom line: if the vulnerable version was live for weeks, change the passwords even if you find no suspicious traces in the logs.
What should you do now? The steps in order
• 1. Update Gravity SMTP to at least version 2.1.5. • 2. Change the password of the email account configured in the plugin — you can set the new password with your provider (for example in your hosting control panel). • 3. Generate new API keys for the connected services (Amazon SES, Google, Mailjet and the like), and revoke the old ones. • 4. Check the email sending log with your provider: has any email gone out that you didn’t send? • 5. Watch for the general signs of a hack — our article on the 8 tell-tale signs will help.
At one of our clients, routine maintenance revealed that Gravity SMTP was stuck on an old version. The update itself took a few minutes — the real work came afterwards: a new SMTP password, a new API key, revoking the old ones and finally reviewing the email sending service’s log. Fortunately no unauthorised email had gone out, but that’s exactly the good scenario: you change the locks before anything has been taken.
Speed, by the way, isn’t overzealousness — it’s the baseline in 2026.
According to Patchstack’s measurements, for the most heavily attacked WordPress vulnerabilities, the weighted median time from public disclosure to the first mass exploitation is just 5 hours. (Source: Patchstack)
This article is the first part of a three-part series. The next parts explain how to choose safer plugins in the first place, and why mass exploitation of published vulnerabilities became attackers’ main weapon in 2026.
Don’t know off the top of your head which versions you’re running? We’ll check
The Gravity SMTP flaw is typical in that it happens quietly: from the outside, your site keeps working perfectly. It’s precisely because of cases like this that we at WPShield continuously monitor the plugins running on our clients’ sites and newly published vulnerabilities.
If you’d like to know whether you’re running a vulnerable plugin, ask for our free quick security check: in 15 minutes we’ll review your site and tell you where you’re exposed to attack — with no obligation and no jargon.
—
Frequently asked questions
What is CVE-2026-4020?
A vulnerability in the Gravity SMTP email sending plugin that affects every version up to and including 2.1.4. Through a REST API endpoint with no permission check, the site’s system report — including the configured SMTP and API credentials — could be retrieved without logging in. The fix is included in version 2.1.5.
How do I know if my site is affected?
Check your Plugins list to see whether you’re running Gravity SMTP, and which version. If the version number is 2.1.4 or older, your site is affected. If an email account or sending service is connected, treat its details as potentially leaked — even if you see no direct evidence of it.
Is it enough to update the plugin?
No. Updating only stops further requests; it doesn’t invalidate data that has already leaked. Wordfence’s more than 17 million blocked attempts show how widespread the attack was — after updating, change your SMTP password and generate new API keys for the connected services.
What should I do if my SMTP password has leaked?
Change the password with your email provider, revoke the old API keys and tokens, then review the email sending log to see whether any unauthorised email was sent in your name. If your account was used for spam or phishing, let the provider know and keep an eye on your domain’s email reputation.
