Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 2.1.5 : update affected systems when convenient.
Data as of 22 Jun 2026, 17:15 UTC
Rated Low by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 2.1.5
What to do
AI-suggested
A patch is available and should be applied: upgrade the Gravity SMTP plugin to version 2.1.5 or later. The vulnerability is fixed in this version. Site administrators should also monitor their web server access logs for requests to '/wp-json/gravitysmtp/v1/tests/mock-data' with the '?page=gravitysmtp-settings' parameter as an indicator of compromise. Blocking known malicious IP addresses identified by security vendors like Wordfence can help reduce exploitation attempts. No additional vendor advisory indicates alternative mitigations or that no action is required.
Description
Threat actors are exploiting an unauthenticated information disclosure vulnerability in the WordPress plugin Gravity SMTP, active on 100,000 sites. [...]