Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data

Attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that allows unauthenticated users to steal sensitive system information including API keys, database details, and server configurations. Security firm Defiant reports they've blocked over 17 million exploit attempts since May, with a surge in June targeting the flaw tracked as CVE-2026-4020. Site owners running versions before 2.1.5 should update immediately and rotate all API credentials, as the exposed tokens could be used to send emails on behalf of their sites.