Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libphp-phpmailer | 5.2.14+dfsg-2.1 | — |
| Debian 13 | libphp-phpmailer | 5.2.14+dfsg-2.1 | — |
| Debian 12 | libphp-phpmailer | 5.2.14+dfsg-2.1 | — |
| Debian 8 | libphp-phpmailer | 5.2.9+dfsg-2+deb8u2 | DSA-3750-1 |
| Debian 7 | libphp-phpmailer | 5.1-1.2 | DLA-770-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | libphp-phpmailer | 6.2.0-2ubuntu0.1~esm1 | USN-5956-1 |
| Ubuntu Pro 20.04 LTS | libphp-phpmailer | 6.0.6-0.1ubuntu0.1~esm1 | USN-5956-1 |
| Ubuntu Pro 18.04 LTS | libphp-phpmailer | 5.2.14+dfsg-2.3+deb9u2ubuntu0.1~esm1 | USN-5956-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libphp-phpmailer | 5.2.14+dfsg-1ubuntu0.1~esm1 | USN-5956-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.5 | php5-phpmailer | 5.2.4-r1 | — |
| Alpine v3.4 | php5-phpmailer | 5.2.0-r1 | — |
| Alpine v3.3 | php-phpmailer | 5.2.4-r0 | — |
| Alpine v3.2 | php-phpmailer | 5.2.4-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
PHPMailer Sendmail Argument Injection
exploit/multi/http/phpmailer_arg_injection
-
WordPress PHPMailer Host Header Command Injection
exploit/unix/webapp/wp_phpmailer_host_header
Exploit-DB 9
- PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution EDB-42221 · webapps · Jun 21, 2017
- WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit) EDB-42024 · remote · May 17, 2017 · verified
- Vanilla Forums < 2.3 - Remote Code Execution EDB-41996 · remote · May 11, 2017
- WordPress Core 4.6 - Remote Code Execution EDB-41962 · webapps · May 3, 2017
- PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution EDB-40986 · webapps · Jan 2, 2017
- PHPMailer < 5.2.18 - Remote Code Execution EDB-40974 · webapps · Dec 29, 2016
- PHPMailer < 5.2.20 - Remote Code Execution EDB-40969 · webapps · Dec 27, 2016
- PHPMailer < 5.2.18 - Remote Code Execution EDB-40968 · webapps · Dec 26, 2016 · verified
- PHPMailer < 5.2.18 - Remote Code Execution EDB-40970 · webapps · Dec 25, 2016
GitHub 17 repositories · most starred shown
-
opsxcq/exploit-CVE-2016-10033 ★ 409 · Dec 26, 2016
PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container
-
GeneralTesler/CVE-2016-10033 ★ 9 · May 10, 2017
RCE against WordPress 4.6; Python port of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
-
Zenexer/safeshell ★ 8 · Dec 29, 2016
Prevent PHP vulnerabilities similar to CVE-2016-10033 and CVE-2016-10045.
-
0x00-0x00/CVE-2016-10033 ★ 6 · Feb 9, 2018
PHPMailer < 5.2.18 Remote Code Execution Exploit
-
pedro823/cve-2016-10033-45 ★ 2 · Nov 19, 2017
Exploits CVE-2016-10033 and CVE-2016-10045
-
j4k0m/CVE-2016-10033 ★ 1 · Aug 31, 2021
Remote Code Execution vulnerability in PHPMailer.
-
awidardi/opsxcq-cve-2016-10033 ★ 1 · Feb 6, 2018
To solve CTFS.me problem
-
liusec/WP-CVE-2016-10033 ★ 1 · Jul 22, 2017
-
chipironcin/CVE-2016-10033 ★ 1 · May 10, 2017
Code and vulnerable WordPress container for exploiting CVE-2016-10033
-
Bajunan/CVE-2016-10033 ★ 0 · May 19, 2017
WordPress 4.6 - Remote Code Execution (RCE) PoC Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress PHPMailer < 5.2.18 - Remote Code Execution http/cves/2016/CVE-2016-10033.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmailer/phpmailer | >= 5.0.0, < 5.2.18 | 5.2.18 | GHSA-5f37-gxvh-23v6 |
Advisories 3
- USN-5956-1 libphp-phpmailer vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-770-1 libphp-phpmailer - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3750-1 libphp-phpmailer - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- https://www.drupal.org/psa-2016-004
- 42221 exploit
- 40969 exploit
- 41962 exploit
- 40968 exploit
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] mailing-list
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- 40974 exploit
- 40986 exploit
- 40970 exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- 41996 exploit
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] mailing-list
- 95108 vdb-entry
- 1037533 vdb-entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- 42024 exploit