CVE-2016-10033 PHPMailer Command Injection
Remote attackers can execute arbitrary code by injecting parameters into the mail command via a crafted Sender property in PHPMailer.
- Exploited in the wild
- Since 7 Jul 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10033?
CVE-2016-10033 is a critical command injection vulnerability in Joomla Joomla\!, published on 30 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Weakness: CWE-88
Which versions are affected by CVE-2016-10033?
2 open source packages ship an affected version, including phpmailer/phpmailer. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmailer/phpmailer Packagist | From 5.0.0 | 5.2.18 |
phpmailer/phpmailer Packagist | From 5.0.0 | 5.2.18 |
Products include Joomla Joomla\!, Phpmailer Project Phpmailer, Wordpress Wordpress.
How do I fix CVE-2016-10033?
Upgrade phpmailer/phpmailer to 5.2.18 or later. US federal agencies must fix it by 28 Jul 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-10033 being exploited?
Yes. Attackers have exploited CVE-2016-10033 in the wild since at least 7 Jul 2025.
Public exploit code: 2 Metasploit modules, 9 Exploit-DB entries, 1 Nuclei template and 17 proofs of concept on GitHub.
Other vulnerabilities in Joomla Joomla\!
- CVE-2023-23752 Joomla! Improper Access Control
- CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
- CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism
- CVE-2022-23797 [20220305] - Core - Inadequate filtering on the selected Ids
Sources
Also known as ALPINE-CVE-2016-10033, CVE-2016-1003, DEBIAN-CVE-2016-10033, DLA-770-1, DSA-3750-1, GHSA-5f37-gxvh-23v6 and 1 more.