← CVE Radar
CVE-2016-10033PHPMailer Command Injection Vulnerability
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
9.8 CRITICALEPSS 99.71%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Jul 28, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2016-10033
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Dec 30, 2016
- Last modified
- 2026-06-17 00:38 UTC
Affected Products
From NVD CPE configurations.
phpmailer projectphpmailer1 version range
- before 5.2.18
wordpresswordpress1 version range
- through 4.7
joomlajoomla!1 version range
- 1.5.0 through 3.6.5
References
- packetstormsecurity.com http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- packetstormsecurity.com http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- seclists.org http://seclists.org/fulldisclosure/2016/Dec/78
- rapid7.com http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- securityfocus.com http://www.securityfocus.com/archive/1/539963/100/0/threaded
- securityfocus.com http://www.securityfocus.com/bid/95108
- securitytracker.com http://www.securitytracker.com/id/1037533
- developer.joomla.org https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- github.com https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- github.com https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- legalhackers.com https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- drupal.org https://www.drupal.org/psa-2016-004
- exploit-db.com https://www.exploit-db.com/exploits/40968/
- exploit-db.com https://www.exploit-db.com/exploits/40969/
- exploit-db.com https://www.exploit-db.com/exploits/40970/
- exploit-db.com https://www.exploit-db.com/exploits/40974/
- exploit-db.com https://www.exploit-db.com/exploits/40986/
- exploit-db.com https://www.exploit-db.com/exploits/41962/
- exploit-db.com https://www.exploit-db.com/exploits/41996/
- exploit-db.com https://www.exploit-db.com/exploits/42024/
- exploit-db.com https://www.exploit-db.com/exploits/42221/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033