Executive brief
PHPMailer is a widely used code library for sending emails from web applications, including popular platforms like WordPress and Drupal. A critical security flaw allows attackers to remotely execute their own commands on the web server by submitting a specially crafted email address through website forms. This could lead to a full takeover of the server, theft of sensitive customer data, or a complete shutdown of the website.
Technical details
A command injection vulnerability exists in PHPMailer's isMail transport mechanism within the mailSend function. The vulnerability is caused by improper neutralization of argument delimiters (CWE-88) when handling the Sender property, specifically failing to sanitize backslash-double quote sequences. A remote, unauthenticated attacker can exploit this by providing a specially crafted email address that passes extra parameters to the underlying system mail command. Successful exploitation allows for arbitrary code execution in the context of the web server user, while failed attempts may cause a denial-of-service. This issue was patched in version 5.2.18.
Affected products
- PHPMailer PHPMailer before 5.2.18
Timeline
- 2016-12-24: disclosed: Initial public disclosure and exploit release
- 2016-12-24: patched: Fixed in version 5.2.18
- 2025-07-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog