Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
2026-06-21T19:24:32Z•9339a46b9b4c1d0de300fe294ecdd7848432693801f735b2c3c8f1c8f8aa15e1
A12A13AI agent RCEApple SecureROMAutoJackBeats Studio BudsCVE-2025-20701CVE-2026-4020CVE-2026-42530EDR bypassFortiBleedFortiGateFortinetGentleKillerGentlemen RaaSGravity SMTPNGINXOAuth token abuseRaaSRansomwareSocGholish takedownWordPressinformation disclosureunpatchable firmwareusbliter8
What happened
Multiple high-impact security stories: attackers are actively exploiting a recently patched information-disclosure bug in the Gravity SMTP WordPress plugin (CVE-2026-4020) to steal API keys and secrets from ~100k installs. Researchers published an unpatchable SecureROM exploit (usbliter8) affecting Apple A12/A13 devices, enabling arbitrary code in silicon-level boot ROM. Critical remote-code-execution flaws in NGINX Open Source (e.g., CVE-2026-42530, CVSS 9.2) were patched by F5, while Apple fixed a high-severity Beats Studio Buds Bluetooth eavesdropping bug (CVE-2025-20701). Other notable: a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 9339a46b9b4c1d0de300fe294ecdd7848432693801f735b2c3c8f1c8f8aa15e1
- Enrichment time
- 2026-06-21T19:24:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.