Gravity SMTP Bug Lets Hackers Steal API Keys

Robert Moore · 2026-06-20

If you're running Gravity SMTP on your WordPress site, you need to pay attention. A recently patched security flaw is now being actively exploited by hackers, and the stakes are high. This plugin is installed on roughly 100,000 websites, so the potential blast radius is significant. The vulnerability, tracked as CVE-2026-4020, carries a CVSS score of 5.3, which puts it in the medium-severity range. But don't let that rating fool you. Even a medium-level flaw can cause major headaches if it exposes the wrong kind of data. ### What the Flaw Actually Does At its core, this is an information disclosure vulnerability. That means an attacker who knows how to trigger it can pull sensitive data straight from your site without needing any credentials. We're talking about configuration details, API keys, secret tokens, and even OAuth tokens. Think about that for a second. If a hacker gets your API keys, they could impersonate your services, send emails from your domain, or access third-party platforms you've connected. It's like handing over the keys to your digital kingdom.  ### Why This Matters for Your Business Here's the thing: Gravity SMTP is used to handle email delivery from WordPress sites. It often connects to services like SendGrid, Mailgun, or Amazon SES. The credentials stored in the plugin are essentially the keys to your email infrastructure. - If OAuth tokens are stolen, attackers can bypass two-factor authentication. - If API keys are exposed, they can send spam or phishing emails using your reputation. - If configuration data leaks, they can map out your entire email pipeline. It's not just about your website. It's about the trust your customers have in your communications. One compromised email account can lead to a full-blown phishing attack against your users. ### Who's at Risk and What You Should Do The vulnerability affects unauthenticated users, meaning anyone on the internet can potentially exploit it. You don't need to be logged in or have any special access. That's what makes this especially dangerous. If you're using Gravity SMTP, here's what I recommend: - Update the plugin immediately to the latest patched version. - Rotate any API keys or OAuth tokens that might have been exposed. - Review your server logs for any suspicious activity, especially around the time the flaw was disclosed. - Consider using a web application firewall to block exploit attempts. ### The Bigger Picture for WordPress Security This isn't an isolated incident. WordPress plugins are a common attack vector because they're often maintained by small teams or individual developers. A single oversight in code can put thousands of sites at risk. That's why it's crucial to stay on top of updates. Not just for Gravity SMTP, but for every plugin and theme you use. Hackers move fast, and they don't wait for you to catch up. I've seen too many site owners ignore update notifications only to regret it later. A few minutes of maintenance can save you weeks of cleanup. ### Final Thoughts If you're responsible for a WordPress site, take this seriously. Patch the vulnerability, change your keys, and keep an eye on your logs. The exploit is already out there, and attackers are actively scanning for vulnerable installations. Don't let your site become the next headline. Stay proactive, and you'll stay protected.