Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 CVSS score: 5.3, is a medium-severity information disclosure flaw that can allow unauthenticated attackers ...

CVE-2026-4020

creationtimestamp| type| source ---|---|--- 2026-03-31 02:21:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mid4jn5ah52r 2026-03-31 02:21:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mid4k5swsi27 2026-03-31 03:17:25+00:00| seen|...