Gravity SMTP WordPress Plugin Exploited to Steal API Keys
Attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin to extract API keys, putting email-sending configurations and site communications at risk.
A critical security flaw in the widely used Gravity SMTP WordPress plugin is being exploited in the wild, allowing unauthenticated attackers to retrieve API keys and potentially hijack email-sending capabilities of affected websites. The plugin, which simplifies SMTP email configuration for WordPress sites, inadvertently exposes sensitive credentials through an insecure endpoint. This exposure can lead to unauthorized access to third-party email services like SendGrid, Mailgun, or SMTP relays, enabling attackers to send spam, phishing emails, or intercept password resets and other transactional messages.
Security researchers have observed active scanning and exploitation attempts targeting the vulnerability. The flaw stems from insufficient authorization checks on a specific AJAX action, which replies with stored API keys in plain text under certain conditions. Since API keys are typically used to authenticate outbound email traffic, their compromise effectively grants an attacker control over a site’s email-sending identity. For e-commerce stores, membership platforms, or any site relying on email for user communication, the consequences can include brand damage, deliverability issues, and fraudulent emails appearing to come from the domain.
Site owners using Gravity SMTP should immediately update to the latest patched version, which restricts access to the sensitive endpoint and sanitizes responses. Additionally, all API keys stored via the plugin should be revoked and regenerated at the email service provider’s dashboard, because it is unknown whether keys have already been exfiltrated. Administrators should also review email-sending logs for any anomalous activity, such as bursts of outgoing messages or unfamiliar sender addresses. If the plugin cannot be updated promptly, disabling it and manually configuring SMTP via the functions.php file or a trusted alternative is a temporary mitigation.
This incident underscores why managed WordPress hosting solutions, like AEU Hosting, that include proactive vulnerability monitoring and automatic plugin updates can significantly reduce the window of exposure for such threats. For businesses without dedicated security teams, relying on a hosting provider that handles timely patching and monitors for exploit attempts in real time helps maintain the integrity of site communications and prevents costly key leakage. Beyond patching, hardening the wp-admin area and limiting unnecessary plugin permissions remain essential practices.
While the vulnerability does not allow direct site takeover, the theft of API keys provides a powerful launching point for further abuse. Given that Gravity SMTP has tens of thousands of active installations, the attack surface is substantial. Website administrators are urged to treat this as a high-priority issue and act swiftly to safeguard their email infrastructure and user trust.