WordPress Vulnerabilities

WordPress 4.3-4.7 - Remote Code Execution (RCE) in PHPMailer

Affects WordPress

4.3
Fixed in WordPress 4.3.7
4.3.1
Fixed in WordPress 4.3.7
4.4
Fixed in WordPress 4.4.6
4.3.2
Fixed in WordPress 4.3.7
4.4.1
Fixed in WordPress 4.4.6
4.4.2
Fixed in WordPress 4.4.6
4.3.3
Fixed in WordPress 4.3.7
4.5
Fixed in WordPress 4.7.1
4.5.1
Fixed in WordPress 4.5.5
4.3.4
Fixed in WordPress 4.3.7
4.4.3
Fixed in WordPress 4.4.6
4.5.2
Fixed in WordPress 4.5.5
4.5.3
Fixed in WordPress 4.5.5
4.3.5
Fixed in WordPress 4.3.7
4.4.4
Fixed in WordPress 4.4.6
4.6
Fixed in WordPress 4.7.1
4.3.6
Fixed in WordPress 4.3.7
4.4.5
Fixed in WordPress 4.4.6
4.5.4
Fixed in WordPress 4.5.5
4.6.1
Fixed in WordPress 4.6.2
4.7
Fixed in WordPress 4.7.1
4.3.7
Fixed in WordPress 4.3.7
4.4.6
Fixed in WordPress 4.4.6
4.5.5
Fixed in WordPress 4.5.5

References

URL
exploit/unix/webapp/wp_phpmailer_host_header
URL
https://github.com/WordPress/WordPress/commit/24767c76d359231642b0ab48437b64e8c6c7f491
URL
http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
URL
https://www.wordfence.com/blog/2016/12/phpmailer-vulnerability/
URL
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
URL
https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
146d60de-b03c-48c6-9b8b-344100f5c3d6

Timeline

Publicly Published
2017-01-11 (about 9 years ago)
Added
2017-01-12 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)

Other

Published
Title
Published
2018-11-11
Title
Simple Link Directory < 5.6.0 - Authenticated PHP Object Injection
Published
2024-05-23
Title
WP Photo Album Plus < 8.7.00.004 - Unauthenticated Arbitrary Shortcode Execution
Published
2025-05-02
Title
Motors - Car Dealer, Rental & Listing WordPress theme < 5.6.66 - Unauthenticated Arbitrary Shortcode Execution
Published
2024-10-18
Title
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
Published
2015-04-02
Title
SimpleCart - File Upload & Execution