CVE-2016-10033
PHPMailer Command Injection Vulnerability
PHP PHPMailerRuntimes & languagesCVSS
9.8CriticalExploit odds (EPSS)99.7%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 25 Dec 2016Exploit code publicExploit-DB
- 30 Dec 2016, 19:00 UTCPublishedCVE List
- 7 Jul 2025Added to CISA KEVCISA KEV
Public exploit code and templates 12
- Exploit modulePHPMailer Sendmail Argument Injection 26 Dec 2016Metasploit
- Exploit moduleWordPress PHPMailer Host Header Command Injection 3 May 2017Metasploit
- Webapps exploitPHPMailer < 5.2.18 - Remote Code Execution 26 Dec 2016Exploit-DB
- Webapps exploitPHPMailer < 5.2.18 - Remote Code Execution 25 Dec 2016Exploit-DB
- Webapps exploitPHPMailer < 5.2.18 - Remote Code Execution 29 Dec 2016Exploit-DB
- Webapps exploitPHPMailer < 5.2.20 - Remote Code Execution 27 Dec 2016Exploit-DB
- Webapps exploitPHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution 2 Jan 2017Exploit-DB
- Webapps exploitPHPMailer < 5.2.20 with Exim MTA - Remote Code Execution 21 Jun 2017Exploit-DB
- Remote exploitVanilla Forums < 2.3 - Remote Code Execution 11 May 2017Exploit-DB
- Webapps exploitWordPress Core 4.6 - Remote Code Execution 3 May 2017Exploit-DB
- Remote exploitWordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit) 17 May 2017Exploit-DB
- Scanner templateWordPress PHPMailer < 5.2.18 - Remote Code ExecutionNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Text from CVE List
Affected versions 1
- n/aaffected: n/aCVE List
References 17
- github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18Fixvia CVE List
- github.com/advisories/GHSA-5f37-gxvh-23v6Advisoryvia CISA KEV
- legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlAdvisoryvia CVE List
- developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlAdvisoryvia CVE List
- exploit-db.com/exploits/42221/Exploitvia CVE List
- exploit-db.com/exploits/40969/Exploitvia CVE List
- exploit-db.com/exploits/41962/Exploitvia CVE List
- exploit-db.com/exploits/40968/Exploitvia CVE List
- exploit-db.com/exploits/40974/Exploitvia CVE List
- exploit-db.com/exploits/40986/Exploitvia CVE List
- exploit-db.com/exploits/40970/Exploitvia CVE List
- exploit-db.com/exploits/41996/Exploitvia CVE List
- exploit-db.com/exploits/42024/Exploitvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2016-10033Referencevia CISA KEV
- drupal.org/psa-2016-004Referencevia CVE List
- github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesReferencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033Referencevia CVE List