Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Remediation
References
Related Vulnerabilities
Liferay Portal CVE-2022-45320 Vulnerability (CVE-2022-45320)
jQuery Validation Uncontrolled Resource Consumption Vulnerability (CVE-2021-21252)
WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.25)
WordPress Plugin Bad Behavior Multiple Cross-Site Scripting Vulnerabilities (2.2.4)
WordPress Plugin Advanced Custom Fields (ACF) 'acf_abspath' Parameter Remote File Include (3.5.1)