Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites

Attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that exposes API keys, OAuth tokens, and detailed system configuration data to anyone who sends a single unauthenticated HTTP request. Wordfence, the WordPress security firm owned by Defiant, says it has blocked m

Related Stories

📰

Exposing Your Cloud: Unintended Access Risks Lurk in MCP Server Exposure

📰

North Korean Hackers Poisoned 140+ npm Packages in an AI Dev Tooling Attack. Here's What Would Have Caught It.

Microsoft finds USB worm that steals cryptocurrency through clipboard hijacking and Tor

📰

Weekly Cloud Security Update: Key Highlights from June 19, 2026