Gravity SMTP flaw exposes API keys on 100K sites

A vulnerability in the Gravity SMTP WordPress plugin, tracked as CVE-2026-4020, leaks API keys, OAuth tokens, and system data via an unauthenticated REST API endpoint. Wordfence has blocked over 17 million exploit attempts since early May 2026. The plugin is installed on roughly 100,000 sites.