SECURITYJun 20 · 09:56 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Hackers are exploiting a patched security flaw in the Gravity SMTP WordPress plugin, affecting approximately 100,000 sites. The vulnerability, CVE-2026-4020, is a medium-severity information disclosure flaw allowing unauthenticated attackers to extract sensitive data like API keys and OAuth tokens.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

Gravity SMTPorganizationWordPressorganizationAPI keystopicCVE-2026-4020topicinformation disclosure flawtopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJun 19 · 20:25 UTC
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
SECURITYJun 6 · 14:09 UTC
Critical Everest Forms Pro flaw exploited to take over WordPress sites
SECURITYApr 6 · 20:24 UTC
Fortinet Issues Emergency Patch for FortiClient Zero-Day
SECURITYJun 6 · 04:19 UTC
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
SECURITYJun 16 · 06:05 UTC
Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw