CVE-2016-10033: PHPMailer isMail mailSend argument injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, confirmed exploitation in the wild via CISA KEV, and an EPSS probability above 99 percent make this an urgent remediation item.

What it is

PHPMailer before 5.2.18 fails to properly sanitize the Sender property in the mailSend function of the isMail transport, allowing a crafted backslash-double-quote sequence to inject extra arguments into the underlying mail command. Because the injected arguments reach a shell command, this argument injection can escalate to arbitrary code execution. PHPMailer is widely embedded in PHP applications, including WordPress and Joomla, so exposure is broad wherever user input reaches the Sender field.

Impact

An attacker can execute arbitrary code on the host running the vulnerable PHP application, gaining the privileges of the web server process. That typically means full compromise of the application and a foothold for lateral movement or persistence.

Attack surface

Reached over the network through any application path that lets attacker-controlled data populate the PHPMailer Sender property; the CVSS vector indicates no authentication and no user interaction are required. The flaw is in the mail transport layer, so it is only reachable where the isMail transport is used and the Sender value is not otherwise constrained.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-07-07 with a 2025-07-28 remediation due date, and EPSS gives a 30-day probability of 0.99714 (99.95th percentile). Multiple public exploit references exist, including Packet Storm, Rapid7 Metasploit, and several Exploit-DB entries, so weaponized exploitation is well established.

What to do

• Upgrade PHPMailer to 5.2.18 or later, or to a current supported release, and confirm the version actually loaded by the application.
• Update or patch bundled copies of PHPMailer shipped inside WordPress, Joomla, Drupal and other frameworks, since the library is often vendored rather than installed separately.
• Where immediate upgrade is impossible, restrict or sanitize any user-supplied value that reaches the Sender property and avoid passing untrusted input into mail transport parameters.
• Disable or replace the isMail transport in favor of a transport that does not invoke a shell command, if the application permits it.
• Follow the CISA KEV required action and applicable BOD 22-01 guidance for cloud services, or discontinue use of the affected product if mitigations cannot be applied.

Detection

• Search application and dependency inventories for PHPMailer versions below 5.2.18, including vendored copies inside CMS and framework directories.
• Monitor web server and application logs for requests containing backslash-double-quote sequences or shell metacharacters in fields that feed mail sending, such as sender or from addresses.
• Alert on unexpected child processes spawned by the web server user, particularly shell or mail-related binaries, which would indicate successful argument injection.
• Review outbound mail and process telemetry for anomalous command execution originating from the PHP process following mail-sending activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.