PHPMailer Multiple Vulnerabilities

Multiple vulnerabilities were identified in PHPMailer, a remote attacker can exploit these vulnerabilities to perform remote code execution on the targeted system.

Note: These products may also be affected: WordPress, Drupal, SugarCRM, and Joomla.

CVE-2016-10033 is being exploited in the wild. PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Hence, the risk level is rated as Extremely High Risk.

[Updated on 2025-07-08]

Updated Risk Level, Description, Impact, Source and Related Links.

Impact

• Remote Code Execution
• Denial of Service

System / Technologies affected

• Updated on 2016-12-29
  Version prior to 5.2.20

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

• Updated on 2016-12-29
  Update to version 5.2.20

Vulnerability Identifier

• CVE-2016-10045
• CVE-2016-10033

Source

• SANS
• CISA

Related Link

• https://isc.sans.edu/diary/Critical+security+update%3A+PHPMailer+5.2.20+%28CVE-2016-10045%29/21855
• https://www.cisa.gov/news-events/alerts/2025/07/07/cisa-adds-four-known-exploited-vulnerabilities-catalog