Gravity SMTP (WordPress): missing authorization flaw (CVE-2026-4162) in up to 2.1.4, reported exploited
Published 04/11/2026 20:05 · Updated 04/11/2026 20:55 (revision 2)
Timeline
3 events over 19 h
- 04/11/2026First report+19 h
- 04/11/2026 20:05Published on WatchtowerPro CISO+49 min
- 04/11/2026 20:55UpdatedVulnCheck's known-exploited list (KEV) now includes this Gravity SMTP flaw and points to…
In short
The Gravity SMTP plugin for WordPress (up to and including version 2.1.4) lacks a proper authorization check. A logged-in user with subscriber-level access can uninstall and deactivate the plugin and delete its settings. VulnCheck reports exploitation; CISA does not list the flaw as known exploited. Shodan estimates about 989,625 internet-facing WordPress servers worldwide, 183,548 of them in the EU (05/11/2026); how many run an affected version is not yet known.
How bad is it
High. An attacker with a basic logged-in account, such as a subscriber, can switch off or remove the email plugin and delete its settings, which can stop the site sending email.
Being exploited.
Severity score
CVSS 3.1 from NVD, from wordfence.com, read 05/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Change or delete that data
- Slow it down or interrupt it
Type: access control bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Gravity SMTP plugin for WordPress, all versions up to and including 2.1.4.
- Attackers with subscriber-level access and above can uninstall and deactivate the plugin and delete plugin options; the flaw can also be exploited via cross-site request forgery.
What to do now
- Update the Gravity SMTP plugin to the latest available release; the vendor has not confirmed in these sources which exact version fixes the flaw, so check the vendor changelog.
- Check which of your WordPress sites run Gravity SMTP 2.1.4 or older.
- Record your current SMTP provider settings so you can restore them if the plugin's options are deleted.
- Check for unexpected plugin deactivation or removal, and for missing mail settings.
- Review subscriber accounts and remove ones you do not recognise. These measures reduce exposure and do not make a vulnerable site safe; only an update does.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer, all 2 sources with their dates and every revision. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
Known exploited (VulnCheck KEV): RocketGenius Gravity SMTP - Missing Authorization Research · CVE-2026-4162 Research