A critical flaw in the Gravity SMTP WordPress plugin is being actively exploited, exposing live API keys to unauthenticated attackers Intelligence briefing updated Jun 20, 2026
Gravity SMTP WordPress plugin flaw (CVE-2026-4020) exposes API keys
incidentopenJun 17, 2026 — Jun 20, 2026
Root sourcewww.wordfence.com
Timeline Coverage
Swipe to explore timeline
-
Gravity SMTP WordPress Plugin flaw exposes API keys, urging patch
thehackernews.com
-
Critical flaw in Gravity SMTP (CVE-2026-4020) exposes API keys
securityonline.info