Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

A vulnerability in the Gravity SMTP WordPress plugin has been exploited by attackers, allowing them to extract sensitive data such as API keys and configuration details from approximately 100,000 sites. The flaw, tracked as CVE-2026-4020, is a medium-severity information disclosure issue that could be used to compromise email integrations and provide attackers with detailed information about the affected websites. A patch has been released, and site owners are advised to update immediately.