Gravity SMTP WordPress Plugin (versions below 2.1.5)

The register_connector_data() method (the function that loads and packages the plugin's internal configuration) triggers when a specific query string is appended to the endpoint URL. Because the access check was never properly implemented, the server happily assembles and returns a detailed system report to anyone who asks. The exposed data includes API keys, OAuth tokens, your WordPress version, active plugins, database structure, and web server details — essentially a roadmap for a follow-on attack. Imagine accidentally leaving your filing cabinet open with a printed directory of every key in the building sitting on top.

1. Update Gravity SMTP to version 2.1.5 or later immediately via your WordPress dashboard.
2. If you were running a vulnerable version with email integrations configured, treat your API keys as compromised — rotate credentials for Amazon SES, Google, Mailjet, Resend, and Zoho.
3. Review your server access logs for requests to /wp-json/gravitysmtp/v1/tests/mock-data — Wordfence has blocked over 17 million exploit attempts to date, with activity spiking around June 6 and seeing peaks of over 4 million requests in a single day.