100,000 Small Business Websites Under Attack Through Email Plugin

What's Happening Right Now

Hackers are actively exploiting a serious security flaw in Gravity SMTP, a WordPress plugin used by about 100,000 small business websites to send emails. This isn't a future threat. Attacks are happening today, and cybercriminals are stealing sensitive credentials that could give them control over your email system and customer communications.

The Details: What This Attack Actually Means

Gravity SMTP is a plugin that helps WordPress websites send emails reliably. It connects your website to email services like Gmail, SendGrid, or Mailgun. To make that connection work, the plugin stores special access credentials called API keys and OAuth tokens.

The vulnerability allows attackers to steal these credentials without needing a password or any special access to your site. Think of it like someone finding a master key that was accidentally left in a visible spot. Once hackers have these credentials, they can send emails as if they're you, access your email service account, and potentially intercept customer communications.

This matters because your business email isn't just about newsletters. It handles password resets, order confirmations, customer support, and sensitive business communications. If attackers control this, they can impersonate your business, steal customer data, or use your email service to send spam and scams that damage your reputation.

Who Is Affected

You should take immediate action if you run a WordPress website for your small business, nonprofit, or side project. This especially matters if you use any email service integration to send automated emails from your site.

Even if you're not sure whether you use Gravity SMTP specifically, it's worth checking. Many small business owners have plugins installed by web developers and don't know exactly what's running behind the scenes. If someone else built or maintains your website, contact them immediately.

What You Should Do Right Now

1. Log into your WordPress dashboard and go to Plugins. Look for anything called "Gravity SMTP" in your installed plugins list.

The Bigger Picture

This attack highlights a growing problem for small businesses. You depend on plugins and tools to run your online presence, but each one can become a security weakness. The reality is that small business sites are attractive targets because they often lack dedicated IT security staff. Cybercriminals know this and actively scan for vulnerable plugins. Staying informed about active threats isn't optional anymore. It's a basic part of running a business online.

How GetCyberRight Can Help

Our Cyber Threat Radar tool tracks exactly these kinds of active attacks targeting small businesses and everyday users. Instead of reading technical security bulletins meant for IT professionals, you get plain-language alerts about threats that actually affect you. We monitor vulnerabilities in the tools you use every day and tell you exactly what to do about them, when it matters most.