Attackers Exploit Gravity SMTP Plugin Flaw in WordPress to Steal API Keys

The Hacker News has reported that hackers are actively exploiting a security flaw in a WordPress plugin (WordPress is a widely used software for building and managing websites) called Gravity SMTP. This plugin helps WordPress websites send email by connecting to an external mail service using the SMTP protocol, which is the standard way email is transmitted over the internet. The vulnerability in the plugin allows attackers to gain access to the API keys stored in its settings. API keys are long secret codes that let one piece of software talk to another, for example letting a WordPress site authenticate to a third-party email sending service. If these keys are stolen, an attacker can use them to impersonate the website owner and abuse the connected services.

The attack works because the Gravity SMTP plugin did not properly protect the area where administrators enter and save their SMTP credentials and API keys. WordPress plugins run inside the WordPress admin dashboard, and normally only logged-in administrators can see settings. However, this bug appears to let an attacker bypass those protections and read the saved keys without having administrator access. This is a serious issue because many website owners store credentials for paid email sending services, and the service may bill per email, so a stolen key can lead to unexpected charges if the attacker sends large volumes of email through the compromised account.

For website owners and businesses, the immediate risk is that an attacker who steals SMTP credentials or API keys can use the victim's email sending reputation to distribute spam or phishing messages. Email providers and spam filters pay attention to the domain and IP address that send email. If a legitimate business domain suddenly starts sending malicious mail, its domain may be added to blocklists, and genuine email from that domain may start going to spam folders or being rejected entirely. This can disrupt customer communication, password reset emails, order confirmations, and other important messages. In addition, if the same API key is used for other services beyond email, the attacker may be able to access those services as well, depending on the permissions connected to the key.

The Gravity SMTP case is part of a broader pattern: WordPress plugins are a common entry point for website attacks. Because WordPress powers a huge portion of the web, any popular plugin with a vulnerability becomes an attractive target. Hackers use automated tools to scan the internet for websites running vulnerable versions, then launch attacks within hours or days of a flaw becoming public. Website owners who do not regularly update their plugins and themes are especially exposed. Even a small, seemingly minor plugin can provide a foothold for attackers to take over an entire site, deface it, steal customer data, or use it to host malicious content.

The immediate protective actions are straightforward. First, if you use the Gravity SMTP plugin, update it to the latest patched version as soon as possible. If you are not sure whether you use it, log in to your WordPress admin area and check the installed plugins list. Second, change all API keys and SMTP passwords that were saved in the plugin, because you should assume they have been compromised. Generate new keys from your email service provider and update the plugin settings with the new credentials. Third, review your WordPress administrator accounts and remove any users who should not have access. Turn on two-factor authentication, which requires a second code from your phone in addition to your password, making it much harder for attackers to log in even if they have stolen a password.

For site owners who prefer to reduce the burden of manual plugin management, a managed WordPress hosting provider can help. AEU Hosting, for example, offers managed WordPress hosting with security features that keep the core software and plugins up to date and monitor for suspicious activity. This kind of service is valuable because it handles many of the routine security tasks that busy website owners often miss, such as applying patches promptly and backing up the site so it can be restored quickly after an incident. No hosting service can guarantee complete protection, but using a security-first provider reduces the chance that a plugin vulnerability like the Gravity SMTP flaw will go unnoticed.