CVE-2016-10033
PHPMailer Command Injection Vulnerability
Description
CVE-2016-10033 is a critical remote code execution vulnerability in PHPMailer, the most widely used PHP library for sending email. The flaw allows an unauthenticated remote attacker to inject extra parameters into the mail command through the sender address field, enabling arbitrary code execution on the underlying server. With a CVSS v3.1 score of 9.8, this argument injection vulnerability affects PHPMailer versions before 5.2.18 and has cascading impact on major CMS platforms including WordPress (up to 4.7) and Joomla (1.5.0 through 3.6.5) that bundle PHPMailer. CISA has added CVE-2016-10033 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 94.47% at the 99.997th percentile makes it one of the most exploited web application vulnerabilities ever documented.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| phpmailer project | phpmailer | < 5.2.18 |
| wordpress | wordpress | <= 4.7 |
| joomla | joomla\! | >= 1.5.0, <= 3.6.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2016/Dec/78(Mailing List, Patch, Third Party Advisory)
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection(Exploit, Third Party Advisory)
- http://www.securityfocus.com/archive/1/539963/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/95108(Broken Link, Exploit, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037533(Broken Link, Third Party Advisory, VDB Entry)
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html(Third Party Advisory)
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18(Patch, Vendor Advisory)
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities(Patch, Vendor Advisory)
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html(Exploit, Patch, Third Party Advisory)
- https://www.drupal.org/psa-2016-004(Third Party Advisory)
- https://www.exploit-db.com/exploits/40968/(Exploit, Patch, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40969/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40970/(Exploit, Patch, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40974/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40986/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41962/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41996/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42024/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42221/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033(US Government Resource)
Weakness Type
CWE-88: Argument Injection
CVE-2016-10033 is classified under CWE-88, Improper Neutralization of Argument Delimiters in a Command (Argument Injection). In PHPMailer's mailSend function, the library constructs a call to the system mail binary using the sender address as a parameter. Because the sender address is not properly sanitized for shell metacharacters, an attacker can inject additional command-line arguments — specifically the -X flag to write log files and -OQueueDirectory to control output location — enabling arbitrary file writes and code execution.
Learn more: CWE-88 — Improper Neutralization of Argument Delimiters in a Command
Impact Analysis
CVE-2016-10033 represents a maximum-impact vulnerability with full compromise of confidentiality, integrity, and availability. The attack is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), as successful exploitation grants the attacker arbitrary code execution on the web server with the privileges of the PHP process. This means full read/write access to the file system, the ability to install backdoors and webshells, access to databases and credentials, and control over the server's network connections. The scope of impact is enormous because PHPMailer is embedded in WordPress, Joomla, Drupal, and thousands of custom PHP applications — any contact form, registration page, or password reset function using PHPMailer's mail transport is a potential entry point. The EPSS score of 94.47% at the 99.997th percentile confirms that CVE-2016-10033 is among the most exploited vulnerabilities ever tracked, with widespread automated exploitation campaigns targeting PHP web applications globally.
Exploit Maturity
CVE-2016-10033 has reached maximum exploit maturity with an extensive arsenal of public exploits available. Multiple exploit proof-of-concepts are published on Packet Storm Security, Exploit-DB (with over 10 separate exploit entries), and a Metasploit module is available via Rapid7. A detailed technical advisory with exploitation walkthrough was published by Legal Hackers. CISA has confirmed active exploitation by adding CVE-2016-10033 to the KEV catalog. The EPSS score of 94.47% at the 99.997th percentile places it in the top 0.003% of all vulnerabilities for exploitation probability. Automated exploitation tools scan for and exploit this vulnerability at scale, targeting any PHP application with an email-sending function that uses the vulnerable isMail transport in PHPMailer.
Remediation
-
Upgrade PHPMailer to version 5.2.18 or later immediately. This is the minimum version that addresses CVE-2016-10033. For modern applications, upgrade to PHPMailer 6.x, which includes comprehensive security improvements and drops the vulnerable isMail transport by default.
-
Update CMS platforms that bundle PHPMailer. Upgrade WordPress to version 4.7.1 or later, Joomla to version 3.6.5+ with security patches, and Drupal installations per PSA-2016-004. Many CMS installations include PHPMailer as a bundled dependency that is not updated by standard package managers.
-
Switch from the mail transport to SMTP in PHPMailer configuration. The vulnerability specifically affects the
isMail()transport that calls the system mail binary. UsingisSMTP()with direct SMTP server connection eliminates this attack vector entirely. -
Implement input validation on email sender addresses at the application level. Strictly validate that sender email addresses conform to RFC 5322 format and reject any addresses containing shell metacharacters, backslash sequences, or encoded special characters.
-
Deploy web application firewall rules to detect and block exploitation attempts targeting PHPMailer. Monitor web server logs for contact form submissions or email-triggering requests containing shell metacharacters in email address fields, particularly backslash-double-quote sequences and
-Xor-Oflags.
Technical Details
CVE-2016-10033 is an argument injection vulnerability in the PHPMailer library's mailSend function, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflecting maximum exploitability and impact. When PHPMailer is configured to use the isMail() transport, the mailSend function passes the sender email address as the fifth parameter to PHP's mail() function, which in turn passes it as a command-line argument to the sendmail binary. The vulnerability arises because PHPMailer fails to properly escape shell metacharacters in the sender address. An attacker can inject a sender address containing escaped characters (specifically using backslash-double-quote sequences) that break out of the intended parameter context and inject additional sendmail command-line arguments. By injecting -OQueueDirectory=/tmp and -X/var/www/html/shell.php, an attacker can cause sendmail to write the email content (including PHP code in the body) to an arbitrary file path on the server, creating a webshell. The affected versions include all PHPMailer releases before 5.2.18. The fix implements proper escapeshellarg() sanitization of the sender parameter before passing it to the mail() function, preventing argument injection through the email address field.
Frequently Asked Questions
Is CVE-2016-10033 being actively exploited?
Yes. CVE-2016-10033 has been actively exploited since its disclosure in December 2016, with widespread automated scanning campaigns targeting PHP applications. CISA has confirmed active exploitation, and the EPSS score of 94.47% at the 99.997th percentile places it among the most exploited vulnerabilities ever tracked.
What products are affected by CVE-2016-10033?
PHPMailer versions before 5.2.18 are directly affected. WordPress versions up to 4.7, Joomla versions 1.5.0 through 3.6.5, and thousands of PHP applications that bundle PHPMailer are also vulnerable. Drupal issued a public service announcement (PSA-2016-004) regarding this vulnerability.
How do I fix CVE-2016-10033?
Upgrade PHPMailer to version 5.2.18 or later (preferably 6.x). Update any CMS platforms (WordPress, Joomla, Drupal) to their latest versions. As an additional defense, switch from the isMail() transport to isSMTP() to eliminate the attack vector entirely.
How severe is CVE-2016-10033?
With a CVSS score of 9.8 (Critical) and an EPSS score of 94.47% at the 99.997th percentile, this is one of the most severe and most exploited web application vulnerabilities. It enables unauthenticated remote code execution on any server running a vulnerable PHPMailer version with the mail transport.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.