PHPMailer Command Injection Vulnerability (CVE-2016-10033)

What is affected, what to do

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

The vulnerability is being actively exploited; treat it as a priority. Update PHPMailer Project PHPMailer to version 5.2.18. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• PHPMailer Project PHPMailer lt *..5.2.18
• WordPress lte *..4.7
• Joomla! CMS lte 1.5.0..3.6.5

Fixed in

• PHPMailer Project PHPMailer 5.2.18

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade PHPMailer to 5.2.18 or later immediately (Composer: composer require phpmailer/phpmailer:^6.0, prefer the current 6.x branch). Bump WordPress to at least 4.7.1 and Joomla to 3.6.5 or newer.
   • Run a full dependency sweep across every webroot (find / -name "class.phpmailer.php" -exec grep -H "VERSION" {} \;) to catch orphan copies bundled inside plugins, themes, legacy CMS trees and custom apps — the library is almost always vendored, not system-installed.
   • Place every internet-facing form that triggers mail (contact, signup, password reset, careers) behind CAPTCHA, rate limiting or a WAF rule, or disable it, until patch level is verified.
   • Switch the PHPMailer transport from isMail() to isSMTP() — the injection vector lives in the mail() backend and disappears entirely when SMTP is used.
   • Sweep web and mail logs for the last twelve months for sender-field indicators (backslash, double quotes, -X, -O sendmail parameters) to identify prior compromise before patching erases evidence.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF rule (ModSecurity/CRS): inspect request parameters treated as email addresses for metacharacters — block pattern (\\\"|\"\\\\|\\\\\\\")|(\s-[OCX]\s) on POST bodies to mail endpoints. Example: SecRule ARGS "@rx \\\\\"" "id:1016033,phase:2,deny,log,msg:'PHPMailer CVE-2016-10033'".
   • Egress hardening: web servers must not initiate outbound connections to arbitrary destinations (DNS, HTTP/S). Restrict Postfix/sendmail to localhost, apply an egress allowlist at the perimeter — this breaks the reverse shells that typically follow this CVE.
   • PHP hardening via php.ini: disable_functions = exec,passthru,shell_exec,system,proc_open,popen, enforce open_basedir per vHost, mount webroot with noexec. Blocks payload execution even when injection succeeds.
   • MTA configuration: wrap sendmail/Postfix so that additional command-line arguments are stripped or rejected; where feasible drop -t and route through a shim that only accepts a fixed argument set.
   • Least privilege for the web process: dedicated no-shell user, no write access to webroot, enforced SELinux/AppArmor profile for php-fpm. Caps blast radius once RCE lands.
   • File-integrity monitoring on webroots (auditd -w /var/www -p wa) — webshells are the dominant post-exploitation artefact for this CVE.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (nginx/Apache): POST requests to mail endpoints containing a backslash-quote sequence in the body. Splunk/KQL: index=web sourcetype=access_combined method=POST (uri_path="*contact*" OR uri_path="*mail*" OR uri_path="*form*") | regex form_data="\\\\\\\\\"".
   • Auditd/Sysmon on Linux: process ancestry of php-fpm or apache2 → /usr/sbin/sendmail → sh/bash/perl/python is highly suspicious. Sigma shape: parent_image: '*/php*' AND image: '*/sh' AND command_line: '*sendmail*'.
   • Suricata/Snort: enable ET SIDs 2023617 and 2023618 (PHPMailer exploit attempt) and raise alert severity to high.
   • EDR: flag any child process of the web server opening a network socket to external IPs on 4444, 1337, 8080, 443 — classic reverse-shell signature after this exploit.
   • Filesystem telemetry: correlate newly created .php, .phtml, .phar files in the webroot within 60 s of a mail-form POST. KQL: DeviceFileEvents | where FolderPath contains "www" and FileName endswith ".php" | join DeviceNetworkEvents on DeviceId.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Source: pwn.watch, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Joomla! Project Joomla\!
• PHPMailer PHPMailer
• WordPress WordPress

Weakness classes (CWE)

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

  Base

  The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

  Entry at MITRE CWE-88

References & sources

• github.comPHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6web
• NVD (NIST)NVD: CVE-2016-10033advisory, pwn-watch
• exploit-db.comexploits/42221web
• exploit-db.comexploits/42024web
• exploit-db.comexploits/41996web
• exploit-db.comexploits/41962web
• exploit-db.comexploits/40986web
• exploit-db.comexploits/40974web
• exploit-db.comexploits/40970web
• exploit-db.comexploits/40969web
• exploit-db.comexploits/40968web
• drupal.orgpsa-2016-004web, x_refsource_CONFIRM, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033web, government-resource, US government resource
• legalhackers.comadvisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vu…web, x_refsource_MISC, Exploit, Patch, Third-party advisory
• github.comPHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-…web, x_refsource_CONFIRM, Patch, Vendor advisory
• github.comPHP advisory: PHPMailerweb, x_refsource_CONFIRM, Patch, Vendor advisory, pwn-watch
• github.comPHPMailer/PHPMailerpackage
• github.comFriendsOfPHP/security-advisories/blob/master/phpmailer/phpmaile…web
• developer.joomla.orgsecurity-centre/668-20161205-phpmailer-security-advisory.htmlweb, x_refsource_CONFIRM, Third-party advisory
• packetstormsecurity.comfiles/140291/PHPMailer-Remote-Code-Execution.htmlweb, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database