Key Points at a Glance
- A vulnerability (CVE-2026-4020) sat in a popular WordPress plugin called Gravity SMTP. Strangers could read internal credentials without logging in.
- The vendor had already fixed the flaw on March 17, 2026. Anyone who installed the update was protected.
- The attacks still surged months later. According to the security firm Wordfence, there were more than 17 million attack attempts, peaking on June 7, 2026.
- The reason: many of the roughly 100,000 affected sites had never installed the update. The open door stayed open.
- The lesson is not a reason to panic, but a simple routine: install updates promptly and know which plugins are running. That protects you from exactly this kind of attack.
Imagine your locksmith has a new, secure lock for your front door. Free of charge, already fitted. All you have to do is arm it. And many people don’t.
That’s exactly what happened in June 2026 to tens of thousands of WordPress sites. A security update had been available since March. Many had never installed it. Three months later, the attacks ran hot.
In this post, we’ll calmly explain what happened, and what you can take away for your own website. No jargon, no scaremongering.
What exactly happened
Many company websites run on WordPress. It’s the system behind the site that lets you manage text and images. WordPress itself is just the core. Plugins handle the rest.
A plugin is a small piece of add-on software. It bolts features onto your website, a contact form, say, or email delivery. One such email plugin is Gravity SMTP. It makes sure the emails your website sends actually arrive.
This plugin had a bug. One interface (a kind of service hatch in the program code) didn’t check who was knocking. It answered everyone, even strangers with no login.
Through this open hatch, attackers could pull out internal data, including credentials for sending email: so-called API keys and access tokens. These are essentially digital passwords that services use to trust one another. In the wrong hands, they’re worth real money.
Why the patch alone wasn’t enough
Here’s the part that makes this case worth learning from.
The vendor fixed the bug quickly. The patched version 2.1.5 had been available since March 17, 2026. The official advisory (CVE-2026-4020) followed on March 30. Anyone who updated their plugin in that window had the hatch shut again.
The problem wasn’t the missing patch. The problem was that no one installed it.
An update only protects you once it’s installed. If it just sits there, nothing happens. The gap stays open, as if the fix had never existed.
That’s exactly what the attackers exploited. They scanned the web for sites running the old version. According to the security service Wordfence, more than 17 million attack attempts were blocked. On June 7 alone there were around 4 million in a single day, three months after the fix.
The lesson we take from this: a patch is an offer, not protection. You create the protection, by installing it.
What this has to do with your plugins
You might be thinking: an isolated case, doesn’t affect me. The numbers say otherwise.
The security provider Patchstack reviews every known WordPress vulnerability each year. Its 2026 report paints a clear picture. The key figures from 2025:
| Metric | Value | What it means |
|---|---|---|
| New vulnerabilities in the WordPress ecosystem | 11,334 | Security gaps keep coming, they are not rare |
| Share in plugins | 91% | Almost every gap sits in an add-on plugin, not in the core |
| No fix at disclosure | 46% | Nearly half have no patch at first |
| Median time to first mass exploitation | 5 hours | For heavily attacked gaps there is barely any time |
Two things stand out.
First: the danger almost always sits in the plugins. 91 percent. The more plugins you run, the more doors your website has. The WordPress core itself is rarely the problem.
Second: speed counts. For the most heavily attacked gaps, it takes an average of just five hours until the first broad wave of attacks. Update weeks later and you’re likely too late.
That sounds unpleasant. But it’s also good news, because the most effective lever is nothing complicated. It’s a habit.
The routine that really protects you
You don’t need a degree in security. You need a fixed process. Here’s what it looks like.
- Get an overview. Write down which plugins run on your site. You’ll find the list in the WordPress admin area under “Plugins.” Anything you don’t recognize needs checking.
- Throw out what you don’t need. Every plugin is another door. Deactivate and delete the plugins you don’t use. Fewer doors, less risk.
- Install updates promptly. Not eventually, but in days, not months. Security updates come before everything else.
- Back up first. A backup is a complete copy of your website. If an update goes wrong, you restore the copy.
- Assign clear responsibility. Someone has to be in charge, whether that’s you, someone internal, or an external partner. Updates that belong to no one don’t happen.
To be honest: no website is ever completely secure. Even a well-kept site can be hit. But you turn yourself from an easy target into an inconvenient one. And that is exactly what automated attacks are not looking for.
If you’d rather not do this yourself, you can [have your WordPress plugins checked for known vulnerabilities]. The same rule applies here: checking is the start, installing is the protection.
What we see in maintenance
An honest word from practice. We’ve looked after websites since 2007. For us, the Gravity SMTP case isn’t a one-off, it’s a pattern.
The most common picture: a site runs for years. No one touches it. “It works” is the motto. Until a plugin with an open gap becomes the way in. Then the panic is big, and the repair costs more than the maintenance would have.
What we’ve learned: updates are boring, and that’s exactly why they get forgotten. The fix isn’t a bigger tool. It’s a fixed date and clear responsibility.
Conclusion
The Gravity SMTP case isn’t a story about brilliant hackers. It’s a story about open doors that stayed open even though the key was already there.
The good news: you don’t need fear, and you don’t need an expensive special package. You need an overview of your plugins, prompt updates, and clear responsibility. That protects you from by far the most common type of attack on WordPress.
Not sure which plugins run on your site, or whether they’re up to date? A short check clears exactly that up.
→ Have your WordPress plugins checked for known vulnerabilities
Frequently Asked Questions
What exactly was the Gravity SMTP vulnerability (CVE-2026-4020)?
Gravity SMTP is a WordPress plugin for sending email. An interface in the plugin didn’t check who was calling it. That let strangers read internal data without logging in, including credentials and digital keys used for email delivery. The vendor fixed the flaw in version 2.1.5 on March 17, 2026.
Am I affected if I use the plugin?
Sites running a version before 2.1.5 were affected. If you’ve updated to 2.1.5 or later, you’re protected against this vulnerability. Check under “Plugins” in the WordPress admin area to see which version you have installed, and update if needed.
Why were there attacks even though a patch had been available for a long time?
A patch only works once it’s installed. Many sites never installed the update. Attackers deliberately searched for these outdated versions. That’s why, according to Wordfence, attacks still rose sharply in June, months after the fix.
How do I protect my WordPress site in general?
With a fixed routine: an overview of all plugins, deleting what you don’t use, installing security updates promptly, taking a backup first, and assigning clear responsibility. According to Patchstack, 91 percent of vulnerabilities sit in plugins. That’s exactly where maintenance pays off most.
Is it enough to update once a year?
No. According to Patchstack, for heavily attacked gaps it takes an average of just five hours until the first wave of attacks. Security updates belong installed promptly, within days, not months. A fixed, regular date makes more sense than a once-a-year effort.
Sources
- Patchstack Database: Gravity SMTP <= 2.1.4 Unauthenticated Sensitive Information Exposure via REST API. patchstack.com
- NVD: CVE-2026-4020, published March 30, 2026. nvd.nist.gov
- Patchstack: State of WordPress Security in 2026. patchstack.com
- heise online: Patch now! Attacks on WordPress websites with Gravity-SMTP plugin. heise.de