WordPress admins, take note: RCE and password reset vulnerabilities revealed
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-10033 | Command Injection RCE in PHPMailer (Ships with WordPress and Joomla) CVE-2016-10033 is an argument/command injection flaw in the mailSend function of PHPMailer's isMail transport, affecting all PHPMailer releases before 5.2.18. When a crafted Sender (From) address containing a backslash-double-quote sequence is passed to the underlying mail command, extra arguments can be injected, allowing an unauthenticated remote attacker to execute arbitrary code on the hosting server. Because PHPMailer is one of the most widely distributed PHP mail libraries and is bundled with WordPress and Joomla, a very large population of sites and PHP applications is potentially affected, though exploitable deployments are those sending mail via the isMail transport with attacker-influenced sender addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-07 and EPSS assigns a 99.7% probability of exploitation within 30 days, so active exploitation should be assumed. Ransomware association is currently listed as unknown. Do: Upgrade PHPMailer to 5.2.18 or later everywhere it is deployed, including bundled copies inside WordPress, Joomla, and other PHP applications, and bring CMS cores current. Audit internet-facing forms, contact handlers, and API endpoints that pass user-supplied email addresses as the Sender/From value, and identify which systems send mail via the isMail transport. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services; treat exploitation as likely given the KEV listing and 99.7% EPSS. | 9.8 | 100% | KEV PoC ×14 |
| masshundreds of millions of sites potentially affected (PHPMailer is bundled with WordPress, which runs roughly 40% of all websites, plus millions of Joomla… | |
| CVE-2017-8295 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwo WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message. NVD description · AI analysis pending | 5.9 | 27% | PoC ×2 |
| — |
Full article391 words · extracted from helpnetsecurity.com · click to collapse
Independent security researcher Dawid Golunski has released a proof-of-concept exploit code for an unauthenticated remote code execution vulnerability in WordPress 4.6 (CVE-2016-10033), and information about an unauthorized password reset zero-day vulnerability (CVE-2017-8295) in the latest version of the popular CMS.
CVE-2016-10033
The vulnerability exists in the PHPMailer library, and can be exploited by unauthenticated remote attackers to gain access to and compromise an target application server on which a vulnerable WordPress Core version is installed (in its default configuration).
“No plugins or non-standard settings are required to exploit the vulnerability,” Golunski noted.
A video demonstration of the exploit has also been released:
The hole has been responsibly disclosed to the WordPress Foundation, and has been plugged in January, with the release of WordPress 4.7.1.
Still, according to the Foundation’s own numbers, nearly 11 percent of all WordPress installation out there are still stuck on the vulnerable version 4.6.
And, as Golunski noted, it’s possible that older WordPress versions are also affected by the same flaw, so the percentage of vulnerable installations could be considerably higher:
CVE-2017-8295
Admins who still run these older versions of the popular CMS should upgrade to newer versions, ideally to the latest one (v4.7.4).
Still, even that might not be a guarantee against compromise, as Golunski has also publicly released information and POC code for an unauthorized password reset vulnerability (CVE-2017-8295) that the WordPress Foundation is yet to patch.
According to him and BeyondSecurity, whose SecuriTeam coordinated the disclosure of the flaw to the WordPress developers, the discovery of the vulnerability dates back to mid-2016. Golunski found it in version 4.3.1 of the CMS.
“WordPress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lead to an attacker gaining unauthorized access to a victim’s WordPress account,” BeyondSecurity explained.
“The vulnerability stems from WordPress using untrusted data by default when creating a password reset e-mail that is supposed to be delivered only to the e-mail associated with the owner’s account.”
Golunski says that the issue was reported to the WordPress security team multiple times, but they did not confirm whether it has been patched.
He ultimately decided to publish his findings, and offer a temporary solution (“users can enable UseCanonicalName to enforce static SERVER_NAME value”).
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/05/04/wordpress-password-reset-vulnerabilities/