I realized that popular Wordpress plugin Contact Form 7 uses this library https://github.com/PHPMailer/PHPMailer.

When I check source of mail, which has been sended from Contact Form 7, it looks like this:

X-Mailer: PHPMailer 5.2.14 (https://github.com/PHPMailer/PHPMailer)
X-WPCF7-Content-Type: text/plain

So, this version is from (Nov 1st 2015).

https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md

The latests one is:

Version 5.2.18 (December 24th 2016)

SECURITY Critical security update for CVE-2016-10033 please update now! Thanks to Dawid Golunski.

Why Contact Form 7 uses old versions of PHPMailer?

up vote 10 down vote accepted

PHPMailer is not part of the plugin, it is shipped with WordPress. So it is up to WordPress to keep it up to date. There is a patch already in ticket #37210.

In the mean time, you can create a mu-plugin, include the newer version of PHPMailer here, create an instance and assign it to the global variable $phpmailer. WordPress will then use that instead of its own outdated version. But be aware that WordPress’ version has some changes that are not compatible with the original class, so you might break some plugins.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.