Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-10033

99
FAUCET Score

CVE-2016-10033 is a critical remote code execution vulnerability in PHPMailer versions prior to 5.2.18, affecting various products including Joomla and WordPress. This flaw allows remote attackers to inject extra parameters into the mail command via a crafted Sender property, leading to arbitrary code execution. With a CVSS score of 9.8 and an EPSS score indicating high exploitability, this vulnerability poses a severe risk. It is actively exploited in the wild, with multiple public exploits, Metasploit modules, and Nuclei templates available, and has garnered significant community discussion and media attention.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.2.18CPE matchmatch criteria
cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*
<= 4.7CPE matchmatch criteria
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
>= 1.5.0, <= 3.6.5CPE matchmatch criteria
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
99.71%
Probability of exploitation in next 30 days
EPSS Percentile
100.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
Added to KEV · Jul 7, 2025
Metasploit: PHPMailer Sendmail Argument Injection · Dec 26, 2016
Nuclei: CVE-2016-10033 · Mar 24, 2021
ExploitDB: EDB-42221 · Jun 21, 2017
This CVE's current EPSS score of 0.9971 is in the 100th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa
Product: phpmailer/phpmailerFixed in: 5.2.18
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-5f37-gxvh-23v6critical

Remote code execution in PHPMailer

Mar 5, 2020

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
packetstormsecurity.com / files/140291/PHPMailer-Remote-Code-Execution.html
ExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com / files/140350/PHPMailer-Sendmail-Argument-Injection.html
ExploitThird Party AdvisoryVDB Entry
developer.joomla.org / security-centre/668-20161205-phpmailer-security-advisory.html
Third Party Advisory
seclists.org / fulldisclosure/2016/Dec/78
Mailing ListPatchThird Party Advisory
github.com / PHPMailer/PHPMailer/releases/tag/v5.2.18
PatchVendor Advisory
github.com / PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
PatchVendor Advisory
legalhackers.com / advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
ExploitPatchThird Party Advisory
drupal.org / psa-2016-004
Third Party Advisory
exploit-db.com / exploits/40968
ExploitPatchThird Party AdvisoryVDB Entry
exploit-db.com / exploits/40969
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/40970
ExploitPatchThird Party AdvisoryVDB Entry
exploit-db.com / exploits/40974
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/40986
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/41962
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/41996
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/42024
ExploitThird Party AdvisoryVDB Entry
exploit-db.com / exploits/42221
ExploitThird Party AdvisoryVDB Entry
rapid7.com / db/modules/exploit/multi/http/phpmailer_arg_injection
ExploitThird Party Advisory
securityfocus.com / archive/1/539963/100/0/threaded
Broken LinkThird Party AdvisoryVDB Entry
securityfocus.com / bid/95108
Broken LinkExploitThird Party AdvisoryVDB Entry
securitytracker.com / id/1037533
Broken LinkThird Party AdvisoryVDB Entry