PHPMailer Multiple Vulnerabilities

Multiple vulnerabilities were identified in PHPMailer, a remote attacker can exploit these vulnerabilities to perform remote code execution on the targeted system.

Note: These products may also be affected: WordPress, Drupal, SugarCRM, and Joomla.

CVE-2016-10033 is being exploited in the wild. PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Hence, the risk level is rated as Extremely High Risk.

[Updated on 2025-07-08]

Updated Risk Level, Description, Impact, Source and Related Links.