Critical severity · published Dec 30, 2016
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
In wildKEV
9.8
CVSS
99.7%
EPSS
Yes
On KEV
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 7, 2025
Federal remediation dueJul 28, 2025
Ransomware campaign useNot known
Affected products
Which versions
JO
Joomla · Joomla
1.5.0 through 3.6.5 · source: NVD
WO
WordPress · WordPress
through 4.7 · source: NVD
PH
PHP · PHP
All versions, or not specified · source: KEV
PH
Phpmailer · Phpmailer Project
before 5.2.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-10033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-10033
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Exploit
http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
Exploit
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
Mailing List
http://seclists.org/fulldisclosure/2016/Dec/78
Exploit
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Broken Link
http://www.securityfocus.com/archive/1/539963/100/0/threaded
Broken Link
http://www.securityfocus.com/bid/95108
More from Joomla
5.3
CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
9.8
CVE-2026-73373
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
9.8
CVE-2026-35221
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
9.8
CVE-2026-40383
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
9.8
CVE-2026-35222
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags