PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
Priority MEDIUM 42CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502 and CWE-915.
Summary
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
Why it matters now
EPSS 0.02229 82nd percentileScored 2026-11-07
Fix Fixed phpmailer/phpmailer (Packagist): 5.2.27, 6.0.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | phpmailer/phpmailer (Packagist) | 5.0.0 to before 5.2.27 | 5.2.27 | Patch available | GHSA-7w4p-72j7-v7c2 |
| — | phpmailer/phpmailer (Packagist) | 6.0.0 to before 6.0.6 | 6.0.6 | Patch available | GHSA-7w4p-72j7-v7c2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- phpmailer/phpmailer (Packagist) Vendor— Affected 5.0.0 to before 5.2.27 Fixed in 5.2.27 Patch available GHSA-7w4p-72j7-v7c2
- phpmailer/phpmailer (Packagist) Vendor— Affected 6.0.0 to before 6.0.6 Fixed in 6.0.6 Patch available GHSA-7w4p-72j7-v7c2
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* | before 5.2.27; 6.0.0 to before 6.0.6 | Vulnerable | Phpmailer Project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* | 3.7 – 5.7 | Vulnerable | WordPress |
- cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* Versions before 5.2.27; 6.0.0 to before 6.0.6 Vulnerable ·Phpmailer Project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions 3.7 – 5.7 Vulnerable ·WordPress
Remediation
- Fix · GHSA-7w4p-72j7-v7c2 phpmailer/phpmailer (Packagist) Fixed in 5.2.27 Advisory →
- Fix · GHSA-7w4p-72j7-v7c2 phpmailer/phpmailer (Packagist) Fixed in 6.0.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-19296
- 2026-10-03 Alias added: GHSA-7w4p-72j7-v7c2
References
Advisory 7
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27
- [debian-lts-announce] 20181228 [SECURITY] [DLA 1591-2] libphp-phpmailer regression update
- DSA-4351
- https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6
- FEDORA-2021-b21bbfa198
- FEDORA-2021-ecf4fed550
- https://nvd.nist.gov/vuln/detail/CVE-2018-19296
Other 6
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-7w4p-72j7-v7c2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2018-19296.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT
Sources
- CVE-2018-19296 · CVE Program
- CVE-2018-19296 · NVD
- FIRST EPSS
- GHSA-7w4p-72j7-v7c2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences