Vulnerability in PHPMailer.

Copy and paste from WordFence..

We're publishing an unscheduled post this afternoon about a vulnerability in PHPMailer that emerged within the past 24 hours. This will have a wide impact on the PHP ecosystem, including on WordPress core.

About 24 hours ago the existence of a remote code execution vulnerability in PHPMailer was published by a researcher. They did not release a proof-of-concept. Since then a proof of concept has been made public a few hours ago and developers are scrambling to release patches to their customers, including the WordPress core team.

We have published full details on our blog with links to discussion and resources, including what to do if you are a WordPress user or a PHP developer....


Regards,



Mark Maunder
Wordfence Founder & CEO

another day another vulnerability in a widely used PHP application...

yea seriously, if it's not one thing it's another

It's a pretty bad design flaw, but end users should be validating input anyways, so this exploit really shouldn't do much damage.