Gravity SMTP WordPress plugin leaks data without authentication, attackers abuse bug

Intelligence Summary

Attackers are actively exploiting an unauthenticated information disclosure flaw in the Gravity SMTP WordPress plugin. The issue allows exposure of sensitive data because it can be triggered without valid credentials. The plugin is deployed on a large number of WordPress sites, increasing the potential impact. Successful exploitation can reveal information that may help further compromise or targeted attacks. Site owners should check for available plugin updates and verify that their Gravity SMTP installation is patched and no longer exposed.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics