CVE-2016-10073: The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to s...

Security readout for executives and security teams

Vanilla Forums before 2.3.1 could trust a crafted HTTP Host header when sending emails. An attacker could make legitimate forum emails use a spoofed domain, including password reset messages, potentially exposing sensitive information. Public exploit references exist, but the bundle does not show confirmed active exploitation. Exposure is likely limited to self-hosted Vanilla Forums installations running versions before 2.3.1, especially internet-facing forums with password reset enabled. The source bundle does not provide CPEs, deployment counts, or hosted-service impact. Treat this as a high-priority legacy exposure if Vanilla Forums is still deployed. The fix path appears to be upgrading to 2.3.1 or later, and public exploit material increases urgency despite no KEV signal. Mitigation focus: Upgrade Vanilla Forums to version 2.3.1 or later per vendor guidance.; Review vendor release notes for any required post-upgrade configuration changes.; Ensure the application only accepts expected hostnames at the web server or proxy layer..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.