Loading story…
Attackers compromised developer systems behind the popular WordPress plugin Gravity Forms and inserted malicious code into official installer packages distributed from the vendor website and via Composer. The tampered releases, identified as 2.9.11.1 and 2.9.12, were available for installation between July 9 and July 10, 2025 and turned legitimate plugin updates into a supply-chain attack affecting WordPress sites that downloaded them from trusted sources.
The malicious code collected site metadata and sent it to attacker-controlled infrastructure at gravityapi[.]org/sites, which could respond with Base64-encoded PHP payloads written into WordPress files. The implanted malware masqueraded as a WordPress plugin and enabled unauthenticated remote code execution through eval, while also supporting creation of admin accounts, file uploads, user enumeration and deletion, and filesystem browsing. RocketGenius removed the malicious code and released Gravity Forms 2.9.13, with guidance to immediately reinstall affected instances and verify the integrity of WordPress files, databases, and logs.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
After the supply-chain compromise was identified, RocketGenius removed the malicious code from the official distribution and released Gravity Forms 2.9.13. The vendor recommended immediate reinstallation of affected instances and integrity checks of WordPress files, databases, and logs.
Attackers compromised the developer systems behind Gravity Forms and modified official installer files, resulting in malicious Gravity Forms 2.9.11.1 and 2.9.12 being distributed from the vendor website or via Composer. The affected installations were those installed between July 9 and July 10, 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-4020** in the RocketGenius **Gravity SMTP** WordPress plugin to extract sensitive configuration data and live email-service credentials from vulnerable sites. The flaw affects versions **2.1.4 and earlier** and stems from an unauthenticated REST API endpoint, `/wp-json/gravitysmtp/v1/tests/mock-data`, whose permission check always returns true; when queried with `page=gravitysmtp-settings`, it can return a detailed JSON system report containing environment data, API keys, secrets, and OAuth tokens tied to providers including **Amazon SES, Google, Mailjet, Resend, and Zoho**. The plugin is installed on roughly **100,000** WordPress sites, raising the risk of credential theft and abuse of legitimate outbound email infrastructure for spam, phishing, or follow-on compromise. **Wordfence** said it blocked more than **17 million** exploitation attempts, including a spike of over **4 million** in a single day, while **CrowdSec** observed at least **412** attacking IPs during earlier scanning and attack activity. RocketGenius released a fix in **Gravity SMTP 2.1.5**, and defenders are being urged to update immediately, rotate any potentially exposed credentials, and review logs for suspicious requests to the vulnerable endpoint.
Jun 29, 2026
Attackers targeted multiple widely used WordPress plugins with critical flaws that enabled site takeover, malware deployment, and remote code execution. The most prominent issue, `CVE-2024-27956` in **WP-Automatic** before version `3.9.2.0`, was exploited through SQL injection to bypass authentication, create rogue administrator accounts, upload malicious files, and fully compromise websites; defenders were told to watch for suspicious admin usernames beginning with `xtw`, renamed WP-Automatic files, and known malicious file hashes. CSIRT.SK also reported more than **5.5 million** exploitation attempts across several WordPress plugin vulnerabilities, including `CVE-2024-27956`, `CVE-2024-2876`, `CVE-2024-2417`, and `CVE-2024-28890`. Separate advisories warned that **Forminator** versions earlier than `1.29.3` contained a critical unrestricted file upload flaw, `CVE-2024-28890`, that could let remote attackers execute code on the server, alongside `CVE-2024-31077` and `CVE-2024-31857`, which exposed sites to SQL injection and cross-site scripting. CSIRT.SK also flagged **Poll Maker** before version `3.4` for `CVE-2024-32514`, an arbitrary file upload vulnerability that could lead to remote code execution. The combined disclosures showed active attacker focus on vulnerable WordPress plugins as an initial access path, prompting urgent patching and compromise checks across exposed sites.
Jul 24, 2026
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 16, 2026