CVE-2016-10045: PHPMailer isMail transport argument injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code and a very high EPSS score make this an urgent patch target despite its age.

What it is

PHPMailer before 5.2.20 fails to properly neutralize shell metacharacters in the isMail transport, because escapeshellarg interacts incorrectly with PHP's internal escaping of the mail() function. An attacker who controls an address field passed to the mailer can inject extra arguments to the underlying sendmail command. This is a bypass of the incomplete fix for CVE-2016-10033, so systems patched only for that earlier flaw remain exposed.

Impact

An unauthenticated remote attacker can pass extra parameters to the mail command and execute arbitrary code in the context of the web server. That typically yields full compromise of the application and its data.

Attack surface

Reached over the network through any application code path that feeds attacker-influenced input (such as a sender or recipient address) into PHPMailer's isMail transport. The CVSS vector shows no privileges and no user interaction required, so exposure depends on whether such a path is reachable.

Exploitation

Not listed in CISA KEV, but EPSS is 0.9758 (99.9th percentile) and multiple references carry Exploit tags, including Packet Storm, Exploit-DB and a Rapid7 Metasploit module, indicating public exploit code exists.

What to do

• Upgrade PHPMailer to 5.2.20 or later, which contains the corrected fix for the CVE-2016-10033 escaping issue.
• Update bundled copies in WordPress, Joomla and other applications, since they ship their own PHPMailer versions.
• Where the isMail transport is not required, switch to SMTP transport to remove the shell invocation path.
• Validate and reject shell metacharacters in any address or header value passed to the mailer.
• Inventory applications and libraries embedding PHPMailer to find unpatched copies.

Detection

• Search web server and application logs for mail command arguments containing shell metacharacters or unexpected flags.
• Monitor for outbound connections or child processes spawned by the web server user that are unusual for the application.
• Check file integrity and process creation events on hosts running PHP applications that use PHPMailer.
• Scan deployed code bases for PHPMailer versions below 5.2.20.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.