Is CVE-2016-10033 exploited in the wild?

Yes. CVE-2016-10033 is known to be exploited in the wild, first recorded on 7 July 2025. Treat it as urgent.

How severe is CVE-2016-10033?

Critical severity, with a CVSS score of 3.1, published 5 March 2020.

Which products and versions are affected?

phpmailer/phpmailer (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.2.18.

Is there a fix for CVE-2016-10033?

Yes. phpmailer/phpmailer (Packagist): upgrade to 5.2.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10033 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-10033?

Check whether you run phpmailer/phpmailer (Packagist) or PHPMailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10033: Remote code execution in PHPMailer

CVE-2016-10033 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-03-05

PHPMailer is a widely used code library for sending emails from web applications, including popular platforms like WordPress and Drupal. A critical security flaw allows attackers to remotely execute their own commands on the web server by submitting a specially crafted email address through website forms. This could lead to a full takeover of the server, theft of sensitive customer data, or a complete shutdown of the website.

Technologies: phpmailer/phpmailer (Packagist), PHPMailer. Vendors: Packagist, PHP.

Quick answers

Is CVE-2016-10033 exploited in the wild?: Yes. CVE-2016-10033 is known to be exploited in the wild, first recorded on 7 July 2025. Treat it as urgent.
How severe is CVE-2016-10033?: Critical severity, with a CVSS score of 3.1, published 5 March 2020.
Which products and versions are affected?: phpmailer/phpmailer (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.2.18.
Is there a fix for CVE-2016-10033?: Yes. phpmailer/phpmailer (Packagist): upgrade to 5.2.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10033 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-10033?: Check whether you run phpmailer/phpmailer (Packagist) or PHPMailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpmailer/phpmailer (Packagist): upgrade to 5.2.18 or later
```
composer require phpmailer/phpmailer:^5.2.18
```

Technical details

A command injection vulnerability exists in PHPMailer's isMail transport mechanism within the mailSend function. The vulnerability is caused by improper neutralization of argument delimiters (CWE-88) when handling the Sender property, specifically failing to sanitize backslash-double quote sequences. A remote, unauthenticated attacker can exploit this by providing a specially crafted email address that passes extra parameters to the underlying system mail command. Successful exploitation allows for arbitrary code execution in the context of the web server user, while failed attempts may cause a denial-of-service. This issue was patched in version 5.2.18.

Affected products

PHPMailer PHPMailer before 5.2.18

Identifiers

CVE-2016-10033
GHSA-5f37-gxvh-23v6

Timeline

2016-12-24: disclosed: Initial public disclosure and exploit release
2016-12-24: patched: Fixed in version 5.2.18
2025-07-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.