Active Gravity SMTP Vulnerability Exploited in the Wild

A critical information-exposure vulnerability (CVE-2026-4020) in the Gravity SMTP WordPress plugin (<= 2.1.4) exposes a site's full System Report — including API keys, secrets, and OAuth tokens — via an unauthenticated REST API endpoint. The flaw is trivial to exploit and is being actively abused at scale (millions of blocked attempts, multiple high-volume IPs); site owners are urged to update to 2.1.5 immediately and rotate any potentially compromised credentials.