CVE-2016-10033
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- PHPMailer Command Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
- CWE
- CWE-88
Affected products
phpmailer_project: phpmailer; wordpress: wordpress; joomla: joomla\!
References
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-20… PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-20… PatchVendor Advisory
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing ListPatchThird Party Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016… ExploitPatchThird Party Advisory
- https://www.exploit-db.com/exploits/40968/ ExploitPatchThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40970/ ExploitPatchThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing ListPatchThird Party Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016… ExploitPatchThird Party Advisory