SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2016-10033

PHPMailer Command Injection Vulnerability

KEVCRITICAL 9.8EPSS 99.7%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 28 July 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
99.71% probability · 100th percentile
CISA KEV
Listed 7 July 2025 · due 28 July 2025
Weakness
CWE-88
Affected
phpmailer project/phpmailer · wordpress/wordpress · joomla/joomla\!
Source
cve@mitre.org

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.