CVE-2016-10033
PHPMailer Command Injection Vulnerability
Published Dec 30, 2016 · updated Jun 16, 2026 · phpmailer project phpmailer
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Timeline
Detection, updates, and resolution for this record.
Dec 30, 2016 · Catalog
Detected
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Jul 7, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jul 28, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jul 28, 2025
Affected
- cpe joomla/joomla!version unspecified
- cpe phpmailer project/phpmailerversion unspecified
- cpe wordpress/wordpressversion unspecified
- vendor PHP PHPMailerversion unspecified
Sources
- CISA KEVCVE-2016-10033
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
cisa.gov - CVE.orgCVE-2016-10033
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-10033
30-day exploitation probability 99.7%
first.org - Exploit Database41962
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database41996
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database42024
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/phpmailer_arg_injection
Public module reference (manual). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_unix/webapp/wp_phpmailer_host_header
Public module reference (average). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
nvd.nist.gov