Signal
Hackers actively exploit information disclosure vulnerability in Gravity SMTP WordPress plugin
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-06-19 20:25 UTCUpdated 2026-06-20 09:56 UTC
rss
cveexploitswordpressplugininfo_disclosure
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
A medium-severity information disclosure vulnerability (CVE-2026-4020) in the Gravity SMTP WordPress plugin, which is installed on approximately 100,000 sites, is being actively exploited by threat actors.
Entities
Gravity SMTP
Score total
1.03
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Active exploitation reported shortly after the vulnerability was patched.
- High number of affected sites increases urgency for updates.
- Attackers are targeting unauthenticated access, making all users vulnerable.
Why it matters
- The vulnerability exposes sensitive credentials that can lead to further site compromise.
- Gravity SMTP is widely used, increasing the potential impact of exploitation.
- Prompt patching is critical to protect affected WordPress sites.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- An unauthenticated information disclosure vulnerability in Gravity SMTP WordPress plugin allows attackers to access sensitive data including API keys and OAuth tokens.
How sources frame it
- Security News Sources: neutral
Consolidated reports confirm active exploitation of CVE-2026-4020 in Gravity SMTP plugin; urgent patching advised.
All evidence
All evidence
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
thehackernews · thehackernews.com · 2026-06-20 09:56 UTC
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
bleepingcomputer_all · bleepingcomputer.com · 2026-06-19 20:25 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- thehackernews (1)
- bleepingcomputer_all (1)
Top origin domains (this list)
- thehackernews.com (1)
- bleepingcomputer.com (1)