Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler

published 2024-11-27 23 mo ago modified 2026-06-17 4 mo ago also GHSA-mj5r-x73q-fjw6 , EUVD-2024-3398

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability.

Patch / fix

fixed in 2 links 1

packagist spencer14420/sp-php-email-handler 1.0.0
Spencer14420 SPEmailHandler-PHP 1.0.0

github.com/Spencer14420/SPEmailHandler-PHP@6f00dd0 commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-12-02)

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
GitHub	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	spencer14420/sp-php-email-handler	<1.0.0	1.0.0

Affected products

Spencer14420 SPEmailHandler-PHP

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary