CVE-2016-10033
PHPMailer: Command Injection
As of , CVE-2016-10033 in PHPMailer is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 7 July 2025
- US federal deadline
- 28 July 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- 2 Metasploit modules and 9 Exploit-DB entries (2 verified)
- Fix
- Vendor advice: github.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
- github.comThis vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used…
- github.com
What the flaw is
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
CISA's description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
The CVE record's description, from mitre
- CVE published
- 30 December 2016
- Assigned by
- mitre
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-88
- Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-77
- Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- Exploit-DB published an exploit (EDB-ID 40970).
- Exploit-DB published an exploit (EDB-ID 40968).
- Exploit-DB published an exploit (EDB-ID 40969).
- Exploit-DB published an exploit (EDB-ID 40974).
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 40986).
- Exploit-DB published an exploit (EDB-ID 41962).
- Exploit-DB published an exploit (EDB-ID 41996).
- Exploit-DB published an exploit (EDB-ID 42024).
- Exploit-DB published an exploit (EDB-ID 42221).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: WordPress PHPMailer Host Header Command Injectionexploit module, rank average
- Metasploit: PHPMailer Sendmail Argument Injectionexploit module, rank manual
- Exploit-DB: WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)EDB-ID 42024, verified by Exploit-DB, 17 May 2017
- Exploit-DB: PHPMailer < 5.2.18 - Remote Code ExecutionEDB-ID 40968, verified by Exploit-DB, 26 December 2016
- Exploit-DB: PHPMailer < 5.2.20 with Exim MTA - Remote Code ExecutionEDB-ID 42221, 21 June 2017
- Exploit-DB: Vanilla Forums < 2.3 - Remote Code ExecutionEDB-ID 41996, 11 May 2017
- Exploit-DB: WordPress Core 4.6 - Remote Code ExecutionEDB-ID 41962, 3 May 2017
- Exploit-DB: PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code ExecutionEDB-ID 40986, 2 January 2017
- Exploit-DB: PHPMailer < 5.2.18 - Remote Code ExecutionEDB-ID 40974, 29 December 2016
- Exploit-DB: PHPMailer < 5.2.20 - Remote Code ExecutionEDB-ID 40969, 27 December 2016
- Exploit-DB: PHPMailer < 5.2.18 - Remote Code ExecutionEDB-ID 40970, 25 December 2016
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org