Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 CVSS score: 5.3, is a medium-severity information disclosure flaw that can allow unauthenticated attackers ...

CVE-2026-4020: Exposure of Sensitive Information to an Unauthorized Actor

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permissioncallback that unconditionally returns true, allowing any...

Malicious code in typescript-mock-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a51f9143ac378f3ef81840f6858a902bd37449fa9b93b0999e021321ddafac The package typescript-mock-data was found to contain malicious code...

MAL-2026-2394 Malicious code in typescript-mock-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a51f9143ac378f3ef81840f6858a902bd37449fa9b93b0999e021321ddafac The package typescript-mock-data was found to contain malicious code...

PT-2023-21363 · Databasir · Databasir

Name of the Vulnerable Software and Affected Versions: Databasir version 1.0.7 Description: The issue is related to a remote code execution RCE vulnerability. It can be exploited via the mockDataScript parameter. Recommendations: For Databasir version 1.0.7, consider restricting access to the...