Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Attackers are exploiting CVE-2026-4020 in the Gravity SMTP WordPress plugin to expose API keys across ~100,000 sites. Update to 2.1.5 and rotate keys.
What’s new: Hackers are exploiting a recently patched vulnerability (CVE-2026-4020) in the Gravity SMTP WordPress plugin, affecting around 100,000 sites. This medium-severity flaw allows unauthenticated attackers to access sensitive data, including API keys and configuration details, through a misconfigured REST API endpoint.
Who’s affected
Site owners using the Gravity SMTP plugin, particularly those with third-party email integrations configured, are at risk. The vulnerability has been actively exploited since early May 2026, with over 17 million exploit attempts recorded.
What to do
- Update the Gravity SMTP plugin to version 2.1.5 immediately.
- Rotate any API keys and credentials that may have been exposed.
- Review server log files for suspicious requests from known malicious IP addresses.
