Hi there.
Thank you for your reply but i can not confirm.
I am running the latest WP version by now (5.2.4) and also the latest BP version (5.0) on diffrent servers and all of them showing a vulnerable warning for the php mailer.
This is only on WordPress installations where BP is installed.
Maybe an idea?