CVE-2016-10033: PHPMailer Command Injection Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed

AliasesALPINE-CVE-2016-10033UBUNTU-CVE-2016-10033DEBIAN-CVE-2016-10033+2 more

Published 30-12-2016Last modified 21-10-2025

Vulnerability summary

CVE-2016-10033 is a critical (CVSS 9.8) Argument Injection vulnerability in PHP PHPMailer. It is known to be exploited: CISA lists it, first on 07-07-2025. EPSS estimates a 99.71% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 16 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

99.71%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits16reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Duplicates 1 · Related 1

MGASA-2017-0022 USN-5956-1 CVE-2016-1003

Timeline

30-12-2016
PublishedVulnerability first disclosed.
07-07-2025
Added to CISA KEVPHPMailer Command Injection Vulnerability
28-07-2025
CISA remediation dueApply mitigations per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

CVSS metrics

7 scores · 5 sources · 3 versions

v3.19.8v3.09.8v2.07.5

EPSS trend

Probability

99.71%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.71% on 19-09-2026

19-09-202619-10-2026

EPSS score

99.71%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 07-07-2025
Federal due date: 28-07-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. github.com/advisories/GHSA-5f37-gxvh-23v6 nvd.nist.gov/vuln/detail/CVE-2016-10033

Public exploits

16 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (legalhackers.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 16 exploits

referenceUnverified
Exploit Reference (rapid7.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaselinuxUnverified
WordPress Core 4.6 - Remote Code Execution
Maturity: poc
exploit-databaseremotephpUnverified
Vanilla Forums < 2.3 - Remote Code Execution
Maturity: poc
exploit-databaseremotephpVerified
WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)
Maturity: weaponized
exploit-databasephpVerified
PHPMailer < 5.2.18 - Remote Code Execution
Maturity: poc
exploit-databasephpUnverified
PHPMailer < 5.2.18 - Remote Code Execution
Maturity: poc
exploit-databasephpUnverified
PHPMailer < 5.2.18 - Remote Code Execution
Maturity: poc
exploit-databasephpUnverified
PHPMailer < 5.2.20 - Remote Code Execution
Maturity: poc
exploit-databasephpUnverified
PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution
Maturity: poc
exploit-databasephpUnverified
PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
Maturity: poc
MetasploitremoteUnverified
PHPMailer Sendmail Argument Injection
exploit/multi/http/phpmailer_arg_injection
Maturity: poc
MetasploitremoteUnverified
WordPress PHPMailer Host Header Command Injection
exploit/unix/webapp/wp_phpmailer_host_header
Maturity: poc

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Alpine2 products

php-phpmailer< 5.2.4-r0
php5-phpmailer< 5.2.0-r1 | < 5.2.4-r1

Debian1 product

libphp-phpmailer< 5.2.14+dfsg-2.1 | < 5.2.9+dfsg-2+deb8u2 | < 5.1-1.2

Joomla1 product

joomla\!≥ 1.5.0, ≤ 3.6.5

Phpmailer_project1 product

phpmailer< 5.2.18

Ubuntu1 product

libphp-phpmailer< 5.2.14+dfsg-1ubuntu0.1~esm1

Wordpress1 product

wordpress≤ 4.7

6 vendors · 7 products

References

29 links

packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.drupal.org/psa-2016-004X Refsource CONFIRMThird Party AdvisoryREPORT
www.exploit-db.com/exploits/42221/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/40969/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/41962/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/40968/ExploitX Refsource EXPLOIT DBPatchThird Party AdvisoryVDB EntryREPORT
legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlX Refsource MISCExploitPatchThird Party AdvisoryREPORT
github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18X Refsource CONFIRMPatchVendor AdvisoryREPORT
www.securityfocus.com/archive/1/539963/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesX Refsource CONFIRMPatchVendor AdvisoryREPORT

Show all 29 references

packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryREPORT
www.exploit-db.com/exploits/40974/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/40986/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/40970/ExploitX Refsource EXPLOIT DBPatchThird Party AdvisoryVDB EntryREPORT
www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionX Refsource MISCExploitThird Party Advisory
www.exploit-db.com/exploits/41996/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2016/Dec/78Mailing ListX Refsource FULLDISCPatchThird Party AdvisoryREPORT
www.securityfocus.com/bid/95108VDB EntryX Refsource BIDBroken LinkExploitThird Party Advisory
www.securitytracker.com/id/1037533VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlX Refsource CONFIRMThird Party AdvisoryREPORT
www.exploit-db.com/exploits/42024/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033Government ResourceUS Government Resource
security.alpinelinux.org/vuln/CVE-2016-10033Advisory
ubuntu.com/security/CVE-2016-10033REPORT
legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.htmlREPORT
ubuntu.com/security/notices/USN-5956-1Advisory
www.cve.org/CVERecord?id=CVE-2016-10033REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
security-tracker.debian.org/tracker/CVE-2016-10033Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities