A critical information disclosure vulnerability in the Gravity SMTP plugin allows unauthenticated attackers to exfiltrate sensitive system configuration data and API keys.

This flaw exists due to a REST API endpoint that lacks a proper permission check, which allows any unauthenticated visitor to trigger the collection of sensitive environment data. By appending specific query parameters, an attacker can force the plugin to return a JSON object containing database credentials, API keys, and internal server paths.

The exposure of this data poses a severe risk to the confidentiality of the WordPress environment. An attacker obtaining database credentials, API tokens, or server paths can facilitate further unauthorized access, privilege escalation, or complete site compromise. With a CVSS score of 7.5, this vulnerability is classified as High severity because it provides attackers with the reconnaissance data necessary to conduct more sophisticated, targeted attacks against the underlying infrastructure.

Immediate Action: Update the Gravity SMTP plugin to the latest available version beyond 2.1.4, which includes the necessary permission checks to secure the REST API.

Proactive Monitoring: Review web server and WordPress access logs for repeated requests to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint, which may indicate reconnaissance activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the specified REST API endpoint until the update can be applied.

Public Exploit Available: Yes, a public proof of concept is available via the referenced GitHub repository.

Given the high sensitivity of the leaked information, including potential API keys and database details, organizations using the Gravity SMTP plugin must prioritize this update. Administrators should verify their current version immediately and apply the patch to prevent unauthorized system information disclosure.