Hackers Exploit Gravity SMTP Word Press Plugin Bug to Expose API Keys

Summary: Threat actors are exploiting CVE-2026-4020, a medium-severity information disclosure flaw (CVSS 5.3) in the Gravity SMTP WordPress plugin installed on about 100,000 sites, using unauthenticated HTTP GET requests to a REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data whose permission_callback unconditionally returns true. Wordfence said appending the ?page=gravitysmtp-settings parameter causes the endpoint to return roughly 365 KB of JSON containing the full System Report, including API keys, secrets, and OAuth tokens, and has blocked more than 17 million exploit attempts since activity began in early May 2026 and spiked around June 6, 2026, reaching over 4,000,000 requests a day.
Bottom line: Live third-party API credentials exposed through this endpoint let an attacker send email on behalf of a site, and the accompanying system report lowers the effort needed to plan follow-on attacks - with over 4 million requests in a single day, scanning at this volume is effectively automated.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-4020
Related: ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026