PT-2026-3796 · Getsimple · My Smtp Contact Plugin+1

Bobby Cooke · CVE-2021-47778 · Published 2026-01-21 · Updated 2026-01-21

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS My SMTP Contact Plugin version 1.1.2

Description PHP code injection allows an authenticated administrator to inject arbitrary PHP code through plugin configuration parameters, which can lead to remote code execution on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-47778

Affected Products

My Smtp Contact Plugin

Getsimple Cms

References · 7

• 🔥 https://github.com/boku7/gsSMTP-Csrf2Xss2RCE · Exploit
• 🔥 https://exploit-db.com/exploits/49774 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47778 · Security Note
• https://github.com/GetSimpleCMS/GetSimpleCMS · Note
• http://get-simple.info · Note
• https://vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection · Note