VulnSocial

CVE-2026-4162Disclosure

LOWCVSS 7.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to uninstall and deactivate the plugin and delete plugin options. NOTE: This vulnerability is also exploitable via a Cross-Site Request Forgery vector.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 3d ago at 1 mentions (2026-04-10); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-04-10: 1Mentions · 2026-04-12: 1Mentions · 2026-04-19: 1Mentions · 2026-04-20: 1PoC Mentioned / Linked · 2026-04-19: 1Patch / Workaround · 2026-04-20: 1Technical Details · 2026-04-10: 1Technical Details · 2026-04-12: 1Technical Details · 2026-04-20: 104-1004-1204-1904-20
Signal classification4 categories
Disclosure
125.0%
General
125.0%
PoC
125.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-101
Disclosure1
2026-04-121
General1
2026-04-191
PoC1
2026-04-201
Patch1
Full discourse4 posts
  • Giuseppe Paternicola@giuseppe_1337
    Patch

    🚨 HIGH: CVE-2026-4162 (CVSS 7.1) - Gravity SMTP WordPress plugin ≤2.1.4 vulnerable to Missing Authorization. Authenticated attackers (subscriber+) can uninstall/deactivate plugin & delete options. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/mKMXVfa2P4

    Post summary

    The tweet alerts on a high‑severity missing authorization flaw in Gravity SMTP WordPress plugin, allowing authenticated users to disable it, and urges users to apply the patch immediately.

    0000071
    26 followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-4162-gravitysmtp-version-2-1-4-high-vulnerability-proof-of-concept CVE-2026-4162 #WordPress plugin #vulnerability gravitysmtp #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge

    Post summary

    A proof‑of‑concept for CVE-2026-4162 on the GravitySMTP WordPress plugin has been disclosed via a link; no active exploitation, patch, or technical details are shared.

    0000065
    6 followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-4162 📊 Severity: 7.1 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4162 #CVE-2026-4162 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/WsFe04iAFy

    Post summary

    A brief announcement of CVE‑2026‑4162 with its severity score and affected platform, but lacking details on exploitation or mitigation.

    0000053
    125 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4162 The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying t… https://www.cve.org/CVERecord?id=CVE-2026-4162

    Post summary

    The message announces that CVE-2026-4162 affects the Gravity SMTP WordPress plugin by allowing unauthorized access due to improper verification, providing a clear technical description but no PoC, exploit, or patch details.

    0000049
    57.0K followersView on X

Explore more

Back to dashboard