The Latest Warning Shot for WordPress Security

According to a recent report from The Hacker News, attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin — a tool used on roughly 100,000 websites to handle email delivery. The flaw, which has already been patched, allowed unauthenticated visitors to access sensitive configuration data, including API keys and OAuth tokens for email services like Amazon SES and Google.

This matters because it’s not a complex breach. The attacker didn’t need a password or any special access. They simply sent a request to a specific URL and the server handed over a treasure trove of information — about 365 KB of JSON containing system details and live credentials. The security firm Wordfence has blocked over 17 million exploit attempts tied to this bug since early May 2026.

Why Small Holes Lead to Big Leaks

This incident highlights a pattern we see again and again: a single misconfigured permission setting can open the door to widespread data exposure. The plugin’s REST API endpoint had a permission check that always returned “true,” meaning anyone — including malicious bots — could trigger it. For a small business relying on WordPress, that one oversight can compromise not just the website but the email services connected to it.

Attackers now have the keys to send spam or phishing emails using your legitimate email provider. Worse, they can see your entire software stack — PHP version, server details, active plugins. That intel helps them plan follow-up attacks. This isn’t a theoretical risk; it’s happening right now, with millions of exploit requests recorded in a single day.

What This Means for Australian SMBs

Australian small and mid-sized businesses often run WordPress sites with multiple plugins to save costs and simplify management. But the convenience of a plugin like Gravity SMTP — used for transactional emails, contact forms, or newsletters — comes with a duty to keep it updated. The vulnerable version was patched in update 2.1.5, yet many businesses delay updates because they worry about breaking their site. That delay is exactly what attackers count on.

If your business stores customer data or processes payments, a compromised email service can lead to reputational damage, regulatory fines under Australia’s Notifiable Data Breaches scheme, and loss of customer trust. The exposure of API keys also means a third-party provider could be charged with fraudulent usage — costs that come back to you.

What You Can Do Now

  • Update the Gravity SMTP plugin to version 2.1.5 or later immediately. If you have automatic updates enabled, verify they are working — especially for plugins that handle sensitive data.
  • Rotate all API keys, OAuth tokens, and secrets connected to the plugin. Assume they have been exposed. Generate new credentials from your email provider’s dashboard (e.g., Amazon SES, Google Workspace, Mailjet).
  • Check your server logs for requests from the known malicious IPs reported by security researchers. Look for any GET requests to the endpoint /wp-json/gravitysmtp/v1/tests/mock-data — especially ones that include the ?page=gravitysmtp-settings parameter.
  • Review all other WordPress plugins for similar permission issues. A simple security audit each quarter can catch misconfigured REST API endpoints before they are exploited.
  • Use a web application firewall (WAF) that blocks unauthenticated access to sensitive plugin endpoints. Many managed WordPress