WordPress plugin vulnerabilities are not new territory, but the current wave of exploitation targeting the Gravity SMTP plugin represents something more dangerous than a routine patch advisory. What appears on the surface to be a medium-severity flaw is actively being weaponized at scale — and the exposed data goes well beyond what most site owners would consider acceptable risk.
A Misconfigured Endpoint With Serious Consequences
The vulnerability at the center of this campaign involves an improperly secured REST API endpoint within the Gravity SMTP plugin, installed on approximately 100,000 WordPress sites. The flaw, present in version 2.1.4 and all earlier releases, stems from a permission callback that unconditionally returns true — effectively granting any unauthenticated HTTP GET request full access to a detailed system report generated by the plugin.
That report is not benign diagnostic data. It can contain a surprisingly sensitive payload:
In short, a single unauthenticated GET request to a known endpoint can hand an attacker a roadmap of the target site's infrastructure — along with the keys to its outbound email operations.
Exploitation Is Already Happening at Scale
This is not a theoretical risk. Security researchers tracking firewall telemetry have documented more than 17 million blocked exploit attempts against protected sites, with activity surging dramatically on June 7 — a single day that saw roughly 4 million requests intercepted. Sustained exploitation activity continued in the days that followed, indicating an organized and deliberate campaign rather than opportunistic scanning.
"The exposure of live third-party API credentials means an attacker could abuse the site's connected email services, while the detailed system report significantly lowers the effort required to plan further attacks against the site."
The practical implications are significant. Stolen email service credentials allow threat actors to impersonate the compromised organization to external recipients — opening the door to phishing campaigns sent from trusted domains, invoice fraud, credential harvesting, and supply chain attacks targeting the victim's own customers or partners. Meanwhile, detailed knowledge of the site's software stack makes follow-on exploitation far more targeted and efficient.
Identifying Compromise in Your Environment
Site administrators who have not yet patched should treat this as urgent. The exploit leaves a detectable signature: look for requests to /wp-json/gravitysmtp/v1/tests/mock-data in your web server access logs, especially those accompanied by the ?page=gravitysmtp-settings query parameter. The presence of these entries — particularly in volume — should be treated as a confirmed indicator of compromise requiring immediate incident response.
Version 2.1.5, released in mid-March, addresses the vulnerability and should be considered a mandatory upgrade for any site running the affected plugin.
A Broader Pattern: WordPress Plugins Remain a Prime Attack Surface
The Gravity SMTP campaign does not exist in isolation. A separate critical vulnerability has emerged in the Avada Builder plugin — used on over one million WordPress sites — involving an unauthenticated arbitrary file deletion flaw rooted in a path traversal weakness. Under the right conditions, exploiting this issue allows an attacker to delete core WordPress configuration files, triggering the site's installation wizard and enabling a full takeover with remote code execution potential. That vulnerability has been patched in Avada Builder version 3.15.4, and while active exploitation has not yet been observed, the attack vector is highly attractive to threat actors and rapid action is warranted.
Taken together, these disclosures reinforce a consistent reality: WordPress plugins represent one of the most reliably exploited surfaces in web security. The ecosystem's openness and the sheer volume of available extensions create an environment where misconfigured permission models and insecure API implementations regularly slip through development and review cycles — only to be discovered under adversarial conditions.
What You Should Do
- Update immediately. Upgrade Gravity SMTP to version 2.1.5 or later without delay. If you use Avada Builder, update to version 3.15.4.
- Audit your access logs. Search for requests to
/wp-json/gravitysmtp/v1/tests/mock-data— any hits should trigger a full incident review. - Rotate all exposed credentials. If your site ran a vulnerable version of Gravity SMTP while connected to email services, treat all associated API keys, OAuth tokens, and service credentials as compromised. Revoke and reissue them immediately.
- Block known malicious IPs. Security researchers have published the most active source IP addresses in this campaign. Add these to your server-level or firewall blocklists.
- Implement a web application firewall. A properly configured WAF can intercept exploit attempts in real time, buying critical response time when new vulnerabilities emerge.
- Audit plugin inventory. Minimize your attack surface by removing unused or unmaintained plugins. Every installed extension is a potential entry point.
- Enable automated update policies. For production WordPress environments, consider enabling automatic minor version updates for plugins to reduce exposure windows on future disclosures.
The medium severity rating assigned to the Gravity SMTP flaw reflects technical scoring criteria — it does not reflect the real-world impact of handing attackers live email credentials and a detailed infrastructure profile without requiring so much as a login attempt. Organizations managing WordPress at scale should evaluate risk in operational terms, not CVSS scores alone.
