WordPress Gravity SMTP Plugin Flaw Lets Attackers Steal API Keys

A critical security flaw in the Gravity SMTP WordPress plugin is being actively exploited by hackers to expose API keys, according to recent reports. Gravity SMTP is a widely used plugin that helps WordPress websites send emails reliably by connecting them to external email services through the Simple Mail Transfer Protocol (SMTP). These email services, such as SendGrid, Mailgun, or Amazon SES, require a unique secret code called an API key to authenticate the website. The plugin stores these keys in its settings, and the vulnerability allows attackers to retrieve them without authorization.

The Gravity SMTP plugin works by letting website owners configure their WordPress site to send emails through a third-party SMTP provider instead of the default PHP mail function, which often ends up in spam folders. To use these providers, the site administrator enters an API key into the plugin's configuration page. This key is supposed to remain private because it grants access to the email service account. The flaw being exploited likely stems from insufficient protection of these stored credentials, possibly through a missing authorization check or an insecure file access issue. Once hackers obtain the API keys, they can impersonate the website's email service.

For website owners and businesses, the consequences of exposed API keys can be severe. Attackers can use the stolen keys to send spam or phishing emails through the legitimate email service, which can damage the website's domain reputation and lead to email deliverability problems. In many cases, email service providers charge based on usage, so victims may face unexpected bills for thousands of unauthorized emails. Worse, if the API key has broad permissions, attackers could potentially access other data within the email service account, such as contact lists or marketing campaigns. Because many website owners reuse API keys across multiple services, a single leaked key can open the door to further compromises.

At this time, specific details about the vulnerability, such as its technical root cause or the exact version affected, have not been disclosed in the source report. However, the fact that hackers are actively exploiting it means that any website using the Gravity SMTP plugin should treat this as an urgent matter. Website administrators should immediately check if they have the plugin installed and look for any available updates from the developer. If an update is not yet available, they should consider temporarily disabling the plugin and reverting to a safer email sending method until a patch is released. Changing the API keys for the connected email service is also a crucial step, as this invalidates any credentials that may have already been stolen.

This incident highlights the importance of proactive security measures for WordPress websites. Managed WordPress hosting services, such as AEU Hosting, often include automatic plugin updates, security monitoring, and expert support that can help website owners respond quickly to emerging threats like this one. By relying on a hosting provider that handles security patches and monitors for suspicious activity, site owners can reduce their exposure to plugin vulnerabilities. In the meantime, all WordPress users should review their installed plugins, remove unused ones, and ensure that API keys are granted the least amount of privilege necessary to function.