Hackers Exploit Gravity SMTP WordPress Plugin Flaw, 17M Attacks Blocked

Executive Briefing

• Exploits target CVE-2026-4020, an unauthenticated info-disclosure flaw in Gravity SMTP affecting 100,000 WordPress sites
• Exposed REST API endpoint leaks API keys, OAuth tokens, email credentials, and server configuration data without authentication
• Wordfence blocked over 17 million exploit attempts, with a single-day spike of 4 million requests on June 7
• Patch available in version 2.1.5 since March 17; admins should also monitor logs for requests to the mock-data endpoint
• Separately, a critical unpatched file-deletion flaw in Avada Builder threatens one million sites with potential full takeover