Cybersecurity & Data Protection
0
UPVOTE
thehackernews.com

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity information disclosure flaw that can allow unauthenticated attackers to extract sensitive data, such as configuration data, API keys, secrets, and OAuth tokens
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
CA

Carlos

16d ago
0 0

Discussion

Take the lead—comment now

Lead the way—your insights can inspire others.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

darkreading.com
Angola's Largest Telco Breached Hours Before IPO

Unitel, Angola's dominant mobile operator, continues to recover from a cyberattack that caused outages the day of the government-owned telco's public offering.
DR

Dark Reading

3h ago
0
schneier.com
Iran Cyberattacks Against Minnesota Water Systems

Attribution is preliminary, and so far it seems no real damage. And it seems like this is a campaign that has targeted at least seven states. And, because this…
SS

Schneier on Security

15h ago
0
darkreading.com
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks.
DR

Dark Reading

16h ago
0
bleepingcomputer.com
Massive ChainDrop npm supply-chain attack infects hundreds of p…

Self-propagating malware named 'ChainDrop' has compromised more than 1, 300 packages with a combined 2 billion monthly downloads on the Node Package Manager (n…
Nirano

Nirano

20h ago
0
thehackernews.com
When Vibe Hacking Turns AI into the Junior Hacker Every Adversa…

The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Securi…
TN

The Hacker News

22h ago
0
thehackernews.com
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as…

cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPan…
TN

The Hacker News

1d ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
When Vibe Hacking Turns AI into the Junior Hacker Every Adversa…

The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Securi…
TN

The Hacker News

22h ago
0
thehackernews.com
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as…

cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPan…
TN

The Hacker News

1d ago
0
thehackernews.com
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader …

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache…
alex but tired

alex but tired

1d ago
0
thehackernews.com
CISA Adds Exploited N-able N-central Flaw to KEV After Customer…

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploit…
TN

The Hacker News

1d ago
0
thehackernews.com
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba…

Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access…
TN

The Hacker News

1d ago
0
thehackernews.com
Google Password Manager Attacks Could Let Malware Hijack Passke…

Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all a…
TN

The Hacker News

1d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest