Gravity SMTP Plugin Flaw Exploited to Steal Credentials

A significant vulnerability in a widely used WordPress plugin is being actively exploited by attackers to steal sensitive credentials and system information from websites. The flaw, tracked as CVE-2026-4020, affects the Gravity SMTP plugin, which is installed on more than 100,000 WordPress sites.

The vulnerability exists in versions 2.1.4 and earlier of the plugin. It stems from an improperly secured REST API endpoint that does not require any authentication. This allows attackers to retrieve detailed system configuration data, including API keys, OAuth tokens, and SMTP credentials for connected email services, simply by sending a single unauthenticated web request.

Security firm Wordfence reported it has blocked more than 17 million exploit attempts targeting this flaw since activity began in early May. Exploitation volume spiked sharply in early June, with over four million blocked requests recorded on June 7 alone. The attack traffic is consistent with widespread, automated scanning from a cluster of IP addresses.

While the flaw does not directly allow attackers to execute code or take over a site, the exposed information is highly valuable. Stolen email service credentials...