CVE-2016-10045

CVSS 3.1: 9.8 critical
EPSS: 98%p100
Published: Dec 30, 2016 · Dec 30, 2016
Modified: Jun 17, 2026

Analyze CVE-2016-10045 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Vendors: phpmailer project wordpress joomla

Products: phpmailer, wordpress, joomla\!

Weakness: CWE-77

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (97.7%)

In the news

3 stories

Vanilla Forums software is still affected by a critical remote code execution zero

Security AffairsMay 12, 17:22 UTC · May 12, 2017VulnerabilityCVE-2016-10073 CVE-2016-10033 CVE-2016-100452 · 1 read

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

The Hacker NewsJan 5, 07:21 UTC · Jan 5, 2017VulnerabilityCVE-2016-10033 CVE-2016-10045 CVE-2016-10074+14 · 2 reads

Critical RCE vulnerabilities affect SwiftMailer, PhpMailer and ZendMail

Security AffairsJan 3, 13:26 UTC · Jan 3, 2017VulnerabilityCVE-2016-10033 CVE-2016-10045 CVE-2016-10074+13