ShellCodeX Intelligence Brief
MEDIUM
Vulnerabilities
Gravity SMTP WordPress flaw CVE-2026-4020 leaks API keys and secrets
Source headline: Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Threat level
Medium
Signal strength
70/100
Source confidence
1 source
Published
2 hours ago
Intelligence Summary
Attackers are exploiting a patched vulnerability in the Gravity SMTP WordPress plugin. The issue, tracked as CVE-2026-4020, is an unauthenticated information disclosure flaw. It can expose sensitive configuration details, including API keys, secrets, and OAuth tokens. The plugin is widely deployed, reportedly on around 100,000 WordPress sites. Site owners should ensure Gravity SMTP is updated to the fixed version and rotate any exposed credentials.
Recommended Action
Review source details and prioritize according to asset exposure.
Topics
Original reporting
The Hacker News
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Open original source
