Critical Vulnerability in PHPMailer – After Update nothing works

Since 3 days everyone is curious about that Security Warning which affects the PHPMailer Script.

Wordfence Statement

Wordpress uses it too and many other Opensource Projects.

WP 4.7 is currently working with the Version 5.2.14

Here is a small list about Security History from Github PHPMailer:

• Please disclose any vulnerabilities found responsibly – report any security problems found to the maintainers privately.
• PHPMailer versions prior to 5.2.20 (released December 28th 2016) are vulnerable to CVE-2016-10045 a remote code execution vulnerability, responsibly reported by Dawid Golunski, and patched by Paul Buonopane (@Zenexer).
• PHPMailer versions prior to 5.2.18 (released December 2016) are vulnerable to CVE-2016-10033 a remote code execution vulnerability, responsibly reported by Dawid Golunski.
• PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to CVE-2015-8476 an SMTP CRLF injection bug permitting arbitrary message sending.
• PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to CVE-2008-5619, a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it’s vitally important that you upgrade and remove this file.

In a Comment it says:

Presently, WordPress Core (and as a result, anything utilising wp_mail()) are unaffected by the recent disclosures, the vulnerabilities require the usage of a PHPMailer feature which WordPress & wp_mail() does not use. This applies to WordPress 4.7, 4.6.x, and all previous secure versions.
A note on plugins: If plugins are correctly utilising wp_mail() they’ll not be affected either, however, if a plugin is doing something wrong, the plugins team will be in contact with the plugin authors.

My first Question: Is your Plugin doing it right? Do we have to be worried about this issue?

I′m still waiting for an update through the WP Admin Panel. They say it will be 4.7.1.

To test all features I “pre” updated the new files such as:
class-phpmailer, class-pop3 and class-smtp.

After this update – I tried to send a test Mail trough your Plugin Settings in the WP Admin. After pressing the Send Button there was a blank page with no content or any error message.

Refreshing the Page brings back the content. Doing it again – same result. No Email is coming through.

My second Question is:
When WordPress pushes the update for the PHPMailer Script – will your Plugin stop working? Are you aware of this issue?

Thanks for your Answer!
Martin

• This topic was modified 7 years, 11 months ago by MikkelCrunch.