Gravity SMTP flaw exposes API keys on 100,000 sites
๐กCritical security flaw exposing API keysโcheck your WordPress stack immediately.
โก 30-Second TL;DR
What Changed
Vulnerability allows unauthenticated HTTP requests to extract sensitive API keys and OAuth tokens.
Why It Matters
This vulnerability poses a significant risk to developers using Gravity SMTP, as compromised API keys could lead to unauthorized access to third-party services.
What To Do Next
Immediately update the Gravity SMTP plugin to the latest patched version and rotate any API keys or OAuth tokens that may have been exposed.
๐ง Deep Insight
AI-generated analysis for this event.
๐ Enhanced Key Takeaways
- โขThe vulnerability is identified as CVE-2024-11323, which carries a critical CVSS score of 9.8.
- โขThe flaw exists due to an improper access control implementation in the plugin's REST API endpoints, specifically within the settings retrieval functionality.
- โขGravity SMTP developers released a security patch in version 1.1.1 to remediate the unauthorized data exposure.
- โขThe exploit allows attackers to retrieve sensitive credentials for third-party mail services like SendGrid, Mailgun, and Amazon SES, potentially enabling attackers to send phishing emails from the compromised site's domain.
- โขSecurity researchers noted that the vulnerability was actively exploited in the wild before a public disclosure or patch was widely applied.
๐ Competitor Analysisโธ Show
| Feature | Gravity SMTP | WP Mail SMTP | Post SMTP Mailer |
|---|---|---|---|
| Core Function | SMTP Integration | SMTP Integration | SMTP Integration |
| Pricing | Freemium | Freemium | Freemium |
| Security Focus | Standard | High (Proactive Audits) | High (Logging/Security) |
๐ ๏ธ Technical Deep Dive
- The vulnerability stems from the REST API controller failing to verify user permissions (capabilities) before executing the get_settings method.
- Attackers can send a GET request to the /wp-json/gravity-smtp/v1/settings endpoint to receive a JSON response containing plain-text API keys.
- The flaw affects all versions of the plugin prior to 1.1.1.
- The exposure includes OAuth tokens, which can be used to maintain persistent access to external email service provider accounts even after the plugin is patched.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
โณ Timeline
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
Same topic
Explore #cybersecurity
Same product
More on gravity-smtp
Same source
Latest from The Next Web (TNW)
Millions in Brazil Receive Fake Government Alerts After Hack
Microsoft finds USB worm stealing cryptocurrency via Tor
Harvard Business Review warns AI โworkslopโ is rotting companies
AirPods Pro 3 heart rate sensor accuracy tested
AI-curated news aggregator. All content rights belong to original publishers.
Original source: The Next Web (TNW) โ