Gravity SMTP vulnerabilities

2 known vulnerabilities in Gravity SMTP from RocketGenius. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Gravity SMTP: Missing Authorization

  CVE-2026-4162Apr 10, 2026RocketGenius

  The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated atta

• 7.5 High severity

  Gravity SMTP: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-4020Mar 31, 2026RocketGeniusEPSS 73.8%

  The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that uncondit