The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow…
Priority CRITICAL 100Exploited in the wildCWE-88Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Why it matters now
Exploitation Active In CISA KEV since 2025-07-07CISA due date 2025-07-28
EPSS 0.99714 99th percentileScored 2026-11-07
Public exploit Yes 12 exploit referencesTagged by NVD and the CNA
Fix Fixed phpmailer/phpmailer (Packagist): 5.2.18
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | phpmailer/phpmailer (Packagist) | 5.0.0 to before 5.2.18 | 5.2.18 | Patch available | GHSA-5f37-gxvh-23v6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- phpmailer/phpmailer (Packagist) Vendor— Affected 5.0.0 to before 5.2.18 Fixed in 5.2.18 Patch available GHSA-5f37-gxvh-23v6
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* | before 5.2.18 | Vulnerable | Phpmailer Project |
| cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* | up to 4.7 | Vulnerable | WordPress |
| cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* | 1.5.0 – 3.6.5 | Vulnerable | Joomla! |
- cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* Versions before 5.2.18 Vulnerable ·Phpmailer Project
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions up to 4.7 Vulnerable ·WordPress
- cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* Versions 1.5.0 – 3.6.5 Vulnerable ·Joomla!
Remediation
- Fix · GHSA-5f37-gxvh-23v6 phpmailer/phpmailer (Packagist) Fixed in 5.2.18 Advisory →
Vendor assessments
Timeline
- 2025-07-07 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2016-10033
- 2026-10-03 Alias added: GHSA-5f37-gxvh-23v6
References
Exploit 12
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- 42221
- 40969
- 41962
- 40968
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- 40974
- 40986
- 40970
- 41996
- 42024
Patch 3
Advisory 3
Other 13
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6
- https://www.exploit-db.com/exploits/42221
- https://www.exploit-db.com/exploits/42024
- https://www.exploit-db.com/exploits/41996
- https://www.exploit-db.com/exploits/41962
- https://www.exploit-db.com/exploits/40986
- https://www.exploit-db.com/exploits/40974
- https://www.exploit-db.com/exploits/40970
- https://www.exploit-db.com/exploits/40969
- https://www.exploit-db.com/exploits/40968
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033
- https://github.com/PHPMailer/PHPMailer
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml
More PHP vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2016-10033 · CVE Program
- CVE-2016-10033 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-5f37-gxvh-23v6 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-10033 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences