PHPMailer Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/07/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| phpmailer/phpmailer | ≥ 5.0.0, < 5.2.18 | 5.2.18 |
| joomla! | ≥ 1.5.0, ≤ 3.6.5 | |
| phpmailer | < 5.2.18 | 5.2.18 |
| wordpress | ≤ 4.7 |
The mailSend function in the default isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.
Fixed in 5.2.18
Filter and validate user input before passing it to internal functions.
https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free