Hackers Exploit WordPress SMTP Plugin With 100,000+ Installs to Steal Sensitive Data

**Executive summary:** The Gravity SMTP WordPress plugin (<= 2.1.4) contains an unauthenticated REST endpoint (CVE-2026-4020) that returns full system reports — including API keys and OAuth tokens — to any requester; active, large-scale exploitation has generated millions of blocked requests and exposed over 100,000 sites, so administrators should update to 2.1.5, rotate any exposed credentials, and monitor access logs for suspicious requests.