Critical Vulnerability in PHPMailer

Critical Vulnerability in PHPMailer

A serious vulnerability has been discovered in the popular email sending library PHPMailer, characterized by the identifier CVE-2016-10033. While full details are pending, the official announcement indicates that attackers could execute arbitrary code with the permissions of the user running the PHP code.

Such vulnerabilities typically grant at least access to the source code of websites, possibly leading to database access, file hosting capabilities, and the ability to modify existing files. In some cases, this could escalate privileges, granting attackers full control over the server.

PHPMailer is used by approximately 9 million websites, including popular content management systems like WordPress, Drupal, 1CRM, SugarCRM, Yii, and Joomla. If your website uses any of these systems, it is crucial to update PHPMailer to version 5.2.18 or higher.