UpHeron
All vulnerabilities

Servers and applications · WordPress core

CVE-2016-10045

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Severity
Critical 9.8
Published
30 Dec 2016
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Joomla!Servers and applications · cpe:a:joomla:joomla\!
  • From 1.5.0 up to 3.6.5
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Every version up to 4.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-10045
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-10045