---
id: "CVE-2016-10033"
kind: "vulnerability"
aliases: ["CVE-2016-10033"]
title: "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "PHP PHPMailer", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "phpmailer project phpmailer", "fixed": ["5.2.18"], "affected": "< 5.2.18", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": [], "affected": "<= 4.7", "ecosystem": "vendor"}, {"name": "joomla joomla\\!", "fixed": [], "affected": ">= 1.5.0, <= 3.6.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "php", "phpmailer", "web-apps"]
not_affected_if: ["unknown"]
published_at: "2016-12-30T19:59:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10033", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra…

PHPMailer's mail() code path fails to sanitize user-supplied input before passing it to a shell, so input can inject commands. An attacker who can reach the vulnerable mail form gets arbitrary code execution inside the application's context, and failed attempts crash it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PHP PHPMailer affected ? fixed ?
- vendor:phpmailer project phpmailer affected < 5.2.18 fixed 5.2.18
- vendor:wordpress affected <= 4.7 fixed ?
- vendor:joomla joomla\! affected >= 1.5.0, <= 3.6.5 fixed ?

## How to check

Check the PHPMailer version in composer.lock or vendor/phpmailer/phpmailer and confirm it is 5.2.18 or newer; unknown whether the sources give a fixed version.

## Fix

Upgrade PHPMailer to a release that includes the fix; the sources do not name the exact version.
CISA's required action: apply vendor mitigations, or discontinue use of the product if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-10033

## From the sources

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_