CVEvulnerability
CVE-2016-10033
CISA Known Exploited Vulnerability
PHPMailer Command Injection Vulnerability — PHP PHPMailer
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
- Added to KEV
- 2025-07-07
- Remediation due
- 2025-07-28
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033
- Status
- Analyzed
- Published
- 2016-12-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-88
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Affected configurations
• phpmailer project phpmailer (< 5.2.18)
• wordpress wordpress (<= 4.7)
• joomla joomla\! (>= 1.5.0 <= 3.6.5)
Related
Weakness · CWE (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
Referenced by CWE · observed example (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
References
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing List, Patch, Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/539963/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95108 Broken Link, Exploit, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037533 Broken Link, Third Party Advisory, VDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 Patch, Vendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities Patch, Vendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Exploit, Patch, Third Party Advisory
- https://www.drupal.org/psa-2016-004 Third Party Advisory
- https://www.exploit-db.com/exploits/40968/ Exploit, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40969/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40970/ Exploit, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40974/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40986/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41962/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41996/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42024/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42221/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing List, Patch, Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/539963/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95108 Broken Link, Exploit, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037533 Broken Link, Third Party Advisory, VDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 Patch, Vendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities Patch, Vendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Exploit, Patch, Third Party Advisory
- https://www.drupal.org/psa-2016-004 Third Party Advisory
- https://www.exploit-db.com/exploits/40968/ Exploit, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40969/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40970/ Exploit, Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40974/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/40986/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41962/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41996/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42024/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42221/ Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033 US Government Resource