The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5956-1 advisory.

  - The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to     pass extra parameters to the mail command and consequently execute arbitrary code via a \ (backslash     double quote) in a crafted Sender property. (CVE-2016-10033)

  - The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to     the mail command and consequently execute arbitrary code by leveraging improper interaction between the     escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this     vulnerability exists because of an incorrect fix for CVE-2016-10033. (CVE-2016-10045)

  - PHPMailer 5.2.23 has XSS in the From Email Address and To Email Address fields of code_generator.php.
    (CVE-2017-11503)

  - An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to     an HTML document to make it usable as an email message body. One of the transformations is to convert     relative image URLs into attachments using a script-provided base directory. If no base directory is     provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and     added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an     unfiltered, user-supplied HTML document, and must not set a base directory. (CVE-2017-5223)

  - PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. (CVE-2018-19296)

  - PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a     double quote character. This can result in the file type being misinterpreted by the receiver or any mail     relay processing the message. (CVE-2020-13625)

  - PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if     such code is injected into the host project's scope by other means). If the $patternselect parameter to     validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global     namespace contains a function called php, it will be called in preference to the built-in validator of the     same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
    (CVE-2021-3603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An unauthenticated, remote attacker can exploit this to pass extra arguments to the sendmail binary, potentially allowing the attacker to execute arbitrary code. (CVE-2016-10033, CVE-2016-10045)

 - An information disclosure vulnerability exists in the REST API implementation due to a failure to properly restrict listings of post authors. An unauthenticated, remote attacker can exploit this, via a wp-json/wp/v2/users request, to disclose sensitive information. (CVE-2017-5487)

 - Multiple cross-site scripting (XSS) vulnerabilities exist in the update-core.php script due to improper validation of input to the plugin name or version header. An unauthenticated, remote attacker can exploit these, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5488)

 - A cross-site request forgery (XSRF) vulnerability exists due to improper handling of uploaded Flash files. An unauthenticated, remote attacker can exploit this, via a specially crafted Flash file, to hijack the authentication of users. (CVE-2017-5489)

 - A cross-site scripting (XSS) vulnerability exists in the class-wp-theme.php script due to improper validation of input when handling theme name fallback. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5490)

 - A security bypass vulnerability exists in the wp-mail.php script due to improper validation of mail server names. An unauthenticated, remote attacker can exploit this, via a spoofed mail server with the 'mail.example.com' name, to bypass intended security restrictions. (CVE-2017-5491)

 - A cross-site request forgery (XSRF) vulnerability exists in the widget-editing accessibility-mode feature due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions for HTTP requests. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted URL, to hijack the authentication of users or cause them to edit widgets. (CVE-2017-5492)

 - A security bypass vulnerability exists in the ms-functions.php script due to the use of weak cryptographic security for multisite activation keys. An unauthenticated, remote attacker can exploit this, via a specially crafted site sign-up or user sign-up, to bypass intended access restrictions. (CVE-2017-5493)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. (CVE-2016-10045)

Marina Glancy reports :

- MSA-17-0001: System file inclusion when adding own preset file in Boost theme

- MSA-17-0002: Incorrect sanitation of attributes in forums

- MSA-17-0003: PHPMailer vulnerability in no-reply address

- MSA-17-0004: XSS in assignment submission page

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.1.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     PHPMailer component in the class.phpmailer.php script     due to improper handling of sender email addresses. An     unauthenticated, remote attacker can exploit this to     pass extra arguments to the sendmail binary, potentially     allowing the attacker to execute arbitrary code.
    (CVE-2016-10033, CVE-2016-10045)

  - An information disclosure vulnerability exists in the     REST API implementation due to a failure to properly     restrict listings of post authors. An unauthenticated,     remote attacker can exploit this, via a     wp-json/wp/v2/users request, to disclose sensitive     information. (CVE-2017-5487)

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the update-core.php script due to improper     validation of input to the plugin name or version     header. An unauthenticated, remote attacker can exploit     these, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2017-5488)

  - A cross-site request forgery (XSRF) vulnerability exists     due to improper handling of uploaded Flash files. An     unauthenticated, remote attacker can exploit this, via a     specially crafted Flash file, to hijack the     authentication of users. (CVE-2017-5489)

  - A cross-site scripting (XSS) vulnerability exists in the     class-wp-theme.php script due to improper validation of     input when handling theme name fallback. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2017-5490)

  - A security bypass vulnerability exists in the     wp-mail.php script due to improper validation of mail     server names. An unauthenticated, remote attacker can     exploit this, via a spoofed mail server with the     'mail.example.com' name, to bypass intended security     restrictions. (CVE-2017-5491)

  - A cross-site request forgery (XSRF) vulnerability exists     in the widget-editing accessibility-mode feature due to     a failure to require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions for HTTP requests. An unauthenticated,     remote attacker can exploit this, by convincing a user     to follow a specially crafted URL, to hijack the     authentication of users or cause them to edit widgets.
    (CVE-2017-5492)

  - A security bypass vulnerability exists in the     ms-functions.php script due to the use of weak     cryptographic security for multisite activation keys. An     unauthenticated, remote attacker can exploit this, via a     specially crafted site sign-up or user sign-up, to     bypass intended access restrictions. (CVE-2017-5493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**Version 5.2.22** (January 5th 2017)

  - **SECURITY** Fix     [CVE-2017-5223](https://web.nvd.nist.gov/view/vuln/detai     l?vulnId=CVE-2017-5223), local file disclosure     vulnerability if content passed to `msgHTML()` is     sourced from unfiltered user input. Reported by     Yongxiang Li of Asiasecurity. The fix for this means     that calls to `msgHTML()` without a `$basedir` will not     import images with relative URLs, and relative URLs     containing `..` will be ignored.

  - Add simple contact form example

  - Emoji in test content

----

**Version 5.2.21** (December 28th 2016)

  - Fix missed number update in version file - no functional     changes

----

**Version 5.2.20** (December 28th 2016)

  - **SECURITY** Critical security update for CVE-2016-10045     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com) and Paul Buonopane     (Zenexer).

----

** Version 5.2.19** (December 26th 2016)

  - Minor cleanup

** Version 5.2.18** (December 24th 2016)

  - **SECURITY** Critical security update for CVE-2016-10033     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com).

  - Add ability to extract the SMTP transaction ID from some     common SMTP success messages

  - Minor documentation tweaks

** Version 5.2.17** (December 9th 2016)

  - This is officially the last feature release of 5.2.
    Security fixes only from now on; use PHPMailer 6.0!

  - Allow DKIM private key to be provided as a string

  - Provide mechanism to allow overriding of boundary and     message ID creation

  - Improve Brazilian Portuguese, Spanish, Swedish,     Romanian, and German translations

  - PHP 7.1 support for Travis-CI

  - Fix some language codes

  - Add security notices

  - Improve DKIM compatibility in older PHP versions

  - Improve trapping and capture of SMTP connection errors

  - Improve passthrough of error levels for debug output

  - PHPDoc cleanup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 5.2.21** (December 28th 2016)

  - Fix missed number update in version file - no functional     changes

----

**Version 5.2.20** (December 28th 2016)

  - **SECURITY** Critical security update for CVE-2016-10045     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com) and Paul Buonopane     (Zenexer).

----

** Version 5.2.19** (December 26th 2016)

  - Minor cleanup

** Version 5.2.18** (December 24th 2016)

  - **SECURITY** Critical security update for CVE-2016-10033     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com).

  - Add ability to extract the SMTP transaction ID from some     common SMTP success messages

  - Minor documentation tweaks

** Version 5.2.17** (December 9th 2016)

  - This is officially the last feature release of 5.2.
    Security fixes only from now on; use PHPMailer 6.0!

  - Allow DKIM private key to be provided as a string

  - Provide mechanism to allow overriding of boundary and     message ID creation

  - Improve Brazilian Portuguese, Spanish, Swedish,     Romanian, and German translations

  - PHP 7.1 support for Travis-CI

  - Fix some language codes

  - Add security notices

  - Improve DKIM compatibility in older PHP versions

  - Improve trapping and capture of SMTP connection errors

  - Improve passthrough of error levels for debug output

  - PHPDoc cleanup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Legal Hackers reports :

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

The first patch of the vulnerability CVE-2016-10033 was incomplete.
This advisory demonstrates the bypass of the patch. The bypass allows to carry out Remote Code Execution on all current versions (including 5.2.19).

ID	Name	Product	Family	Severity
172589	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : PHPMailer vulnerabilities (USN-5956-1)	Nessus	Ubuntu Local Security Checks	critical
98260	WordPress 3.7.x < 3.7.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98259	WordPress 3.8.x < 3.8.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98258	WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98257	WordPress 4.0.x < 4.0.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98256	WordPress 4.1.x < 4.1.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98255	WordPress 4.2.x < 4.2.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98254	WordPress 4.3.x < 4.3.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98253	WordPress 4.4.x < 4.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98252	WordPress 4.5.x < 4.5.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98251	WordPress 4.6.x < 4.6.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98250	WordPress 4.7.x < 4.7.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
100280	F5 Networks BIG-IP : PHPMailer vulnerability (K73926196)	Nessus	F5 Networks Local Security Checks	critical
97812	FreeBSD : moodle -- multiple vulnerabilities (f72d98d1-0b7e-11e7-970f-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
96606	WordPress < 4.7.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96574	Fedora 24 : php-PHPMailer (2017-c3dc97e1e1)	Nessus	Fedora Local Security Checks	critical
96319	Fedora 25 : php-PHPMailer (2016-6941d25875)	Nessus	Fedora Local Security Checks	critical
96172	FreeBSD : phpmailer -- Remote Code Execution (3c4693de-ccf7-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-10045

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical