Gravity SMTP WordPress plugin under active exploit for info disclosure

Affected Systems

Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. Specific vulnerable versions not disclosed in available data.

Exploitation Status

Active exploitation confirmed. Threat actors are currently exploiting this unauthenticated information disclosure vulnerability in the wild.

Business Impact

Unauthenticated attackers can access sensitive information from affected WordPress sites without credentials. With 100,000 installations, attack surface is significant. No CVE assigned yet, suggesting disclosure may be recent. Exposed information could include SMTP credentials, email configurations, API keys, or other sensitive data stored by the plugin, potentially enabling further compromise including email account takeover or lateral movement.

Urgency

🔴 Immediate

Recommended Actions

• Immediately identify all WordPress instances running Gravity SMTP plugin using asset inventory or vulnerability scanners
• Update Gravity SMTP to the latest patched version if available, or disable/uninstall the plugin until patch is confirmed
• Review WordPress access logs for suspicious unauthenticated requests to Gravity SMTP endpoints or configuration files
• Rotate SMTP credentials and API keys configured in Gravity SMTP as a precautionary measure
• Monitor for unauthorized email activity or configuration changes on affected WordPress sites