Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites

Attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that exposes API keys, OAuth tokens, and detailed system configuration data to anyone who sends a single unauthenticated HTTP request. Wordfence, the WordPress security firm owned by Defiant, says it has blocked m

Related Stories

Microsoft finds USB worm that steals cryptocurrency through clipboard hijacking and Tor

📰

Weekly Cloud Security Update: Key Highlights from June 19, 2026

📰

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

📰

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution