Home Cybersecurity Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Cybersecurity

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Asad Ijaz June 20, 2026 2 min read
Hackers Exploit Gravity Smtp Wordpress Plugin Bug To Expose Api Keys

Cybersecurity experts have uncovered a concerning vulnerability in the Gravity SMTP WordPress plugin that allows hackers to expose sensitive API keys. The flaw was discovered by researchers at NetworkUstad, a leading cybersecurity news outlet, who have warned WordPress site owners to urgently update the plugin to the latest version.

Gravity SMTP Plugin Vulnerability Exposes API Keys

The Gravity SMTP plugin, which is used by over 200,000 WordPress websites to manage email delivery, contains a security bug that can be exploited by attackers to gain access to the plugin’s API keys. These API keys are used to authenticate connections to external email services, and if compromised, can allow hackers to send malicious emails from the affected websites.

How the Vulnerability Works

The vulnerability lies in the way the Gravity SMTP plugin handles and stores its API keys. Researchers found that the plugin was storing these sensitive credentials in the WordPress database in plain text, without any encryption or obfuscation. This makes it relatively easy for attackers to locate and extract the API keys, especially if they have already gained some level of access to the WordPress site.

Potential Impact and Affected Websites

The exposure of API keys through this vulnerability can have serious consequences for website owners. Hackers can use the compromised credentials to send spam, phishing, or malware-laden emails from the affected websites, potentially damaging their reputation and putting their users at risk. the stolen API keys could be sold on the dark web, fueling further cybercrime activities.

Gravity SMTP Plugin Developer Response

The Gravity SMTP plugin developers have acknowledged the vulnerability and have released a patch to address the issue. In a statement, the company said, “We take the security of our plugin and the websites that rely on it very seriously. As soon as we were made aware of this vulnerability, we worked quickly to develop a fix and release an update to protect our users.”

Recommended Actions for WordPress Site Owners

WordPress site owners who are using the Gravity SMTP plugin are strongly advised to update to the latest version immediately. The update includes a fix for the vulnerability and will ensure that the API keys are properly secured. it is recommended to change any existing API keys that may have been compromised as a result of this flaw.

Avatar Of Asad Ijaz
Asad Ijaz

Editor & Founder

Lead Networking Architect and Editor at NetworkUstad. CCNP and CCNA certified, with 10+ years of experience in enterprise network design, implementation, and troubleshooting. Writes practical tutorials on routing, IPv4 management, network automation, and security fundamentals.

All Posts Website

Related Articles

Cryptography Fundamentals Illustration Showing Symmetric And Asymmetric Encryption Key Pairs With A Padlock Formed From Binary Code
Cybersecurity

Cryptography Fundamentals: How Encryption Actually Protects Your Data

Cryptography is the science that makes every secure connection, every encrypted message, and every digital signature on the internet possible. This guide covers cryptography fundamentals from the basics of symmetric and asymmetric encryption through hashing, digital signatures, PKI, and the post-quantum standards that will define security for the next generation.

Imran Khan 19 min read
Featured Illustration Showing Common Cyber Attack Types Including Phishing, Ransomware, Sql Injection, Ddos Attacks, Mitm Attacks, Exploit Attacks, Supply Chain Attacks, And Credential Attacks With A Hacker And Cybersecurity Dashboard.
Cybersecurity

Common Cyber Attack Types: How Hackers Actually Break In

Understanding how hackers break into systems is the first step to stopping them. This guide covers the most common cyber attack types in 2026 — from phishing and ransomware to SQL injection and supply chain attacks — with real-world examples, verified statistics, and the defences that actually work against each one.

Imran Khan 15 min read
8 Cissp Domains Explained With Cybersecurity Wheel Showing Official Isc2 Common Body Of Knowledge Exam Domains And 2026 Certification Guide
Cybersecurity

Understanding Security Domains: A Complete Guide to the 8 CISSP Domains

The CISSP certification is built around eight security domains that together form the Common Body of Knowledge (CBK). Whether you are preparing for the exam or simply want to understand how security professionals think about protecting organisations, this guide breaks down every domain, what it covers, and how much it weighs in the current exam.

Imran Khan 13 min read
Subscribe
Subscribe