WordPress Plugin Flaw Puts Business Email and Payment Systems at Risk

What Happened

Cybercriminals are actively exploiting a security flaw in Gravity SMTP, a popular WordPress plugin used by thousands of small businesses to send emails from their websites. The vulnerability allows attackers to steal API keys and server credentials that control email systems, payment processors, and other critical business services. This is happening right now, and affected businesses may not realize their credentials have been compromised.

The Details

Gravity SMTP helps WordPress websites send emails reliably through services like Gmail, SendGrid, Mailgun, and others. To work properly, the plugin stores sensitive credentials and API keys that essentially act like master passwords for these services.

The vulnerability allows unauthorized people to access these stored credentials without needing to log into your WordPress dashboard. Think of it like leaving a spare key under your doormat, except you didn't know the doormat was there. Attackers are scanning the internet specifically looking for websites running vulnerable versions of this plugin.

Once attackers have your API keys, they can send emails that appear to come from your business, access customer communications, or even manipulate payment processing systems depending on which services you use. They can also use your email sending capacity for spam or phishing attacks, which could get your domain blacklisted and damage your business reputation.

Who Is Affected

This primarily impacts small business owners, online store operators, and anyone running a WordPress website that uses Gravity SMTP for email functionality. If you run a WordPress site and aren't sure whether you use this plugin, you need to check immediately.

Web developers and marketing agencies managing client websites should also take immediate action. You may be responsible for multiple sites using this vulnerable plugin, multiplying your exposure and responsibility to clients.

What You Should Do Right Now

1. Log into your WordPress dashboard and go to Plugins. Look for "Gravity SMTP" in your installed plugins list. If you see it, check the version number and update to the latest version immediately.

The Bigger Picture

WordPress powers over 40% of all websites, making plugins like Gravity SMTP attractive targets for attackers. When a single vulnerability affects thousands of sites simultaneously, cybercriminals move quickly to exploit as many as possible before patches are applied. This incident reminds us that website security isn't just about strong passwords. The tools and plugins we rely on daily can become unexpected weak points. Staying informed about emerging threats helps you respond quickly before criminals can cause damage.

How GetCyberRight Can Help

Our Cyber Threat Radar tool tracks emerging vulnerabilities and active exploits affecting WordPress and web infrastructure in real time. Instead of learning about threats days or weeks after they emerge, you'll get timely alerts about risks that actually affect the platforms you use. For small business owners managing websites alongside everything else, this early warning system helps you stay ahead of attackers without becoming a security expert yourself.