PT-2016-4560 · Php+4 · Phpmailer+4

Dawid Golunski + 1 · Published 2016-12-29 · Updated 2025-07-13 · CVE-2016-10033

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHPMailer versions prior to 5.2.18 Wordpress version 4.6

Description The issue allows remote attackers to execute arbitrary code. This can be achieved by passing extra parameters to the mail command via a crafted Sender property in PHPMailer. There is a potential for remote code execution in Wordpress 4.6.

Recommendations For PHPMailer versions prior to 5.2.18, update to version 5.2.18 or later to resolve the issue. For Wordpress version 4.6, update to a newer version to mitigate the risk of remote code execution.

Exploit

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

ALT-PU-2016-2512

ALT-PU-2017-1015

ALT-PU-2023-1810

ALT-PU-2023-1837

BDU:2025-11542

CVE-2016-10033

DLA-770-1

DSA-3750-1

DSA-3750-2

GHSA-4PC3-96MX-WWC8

GHSA-5F37-GXVH-23V6

MGASA-2017-0022

USN-5956-1

Affected Products

Alt Linux

Linuxmint

Phpmailer

Ubuntu

Wordpress

References · 86

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/Zenexer/safeshell · Exploit
• 🔥 https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2019-16693.md · Exploit
• 🔥 https://github.com/kkirsche/CVE-2019-16692 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 https://exploit-db.com/exploits/42024 · Exploit