CVE-2007-3215: PHPMailer

Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days.

PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.

Affected products

• PHPMailer PHPMailer: version 1.7 only; version 1.7.1 only; version 1.7.2 only; version 1.7.3 only; version 1.73 only

Published 2007-06-14. Last modified 2026-06-16.