> When configured to use CLI sendmail, That's not correct. PHPMailer can be configured to send mail through raw SMTP, by directly invoking sendmail, or by call

> When configured to use CLI sendmail, That's not correct. PHPMailer can be configured to send mail through raw SMTP, by directly invoking sendmail, or by calling PHP's mail() function (which is itself a wrapper around sendmail). This vulnerability affects only the last mode, when PHP's mail() calls sendmail. If you have PHPMailer configured to call sendmail directly, this vulnerability does not apply.