Hey Jeff,

I just wanted to point out that the WordFence article you link, while saying "Affects WordPress" in the title, also says:
There is no known exploit publicly available for WordPress core or any WordPress theme or plugin at this time.

Going on 2.5 weeks later, there are still no known vulnerabilities in PHPMailer that were exploitable in WordPress core. We did upgrade the package anyway out of an abundance of caution.