Splitting from T154209. The PHPMailer dependency must be updated to 5.2.21 due to recent vulnerability reports:

• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Extension:EmailPage seems to be using a vulnerable version of PHPMailer.