CVE-2021-47778 GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection
An authenticated administrator can inject arbitrary PHP code via plugin configuration, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47778?
CVE-2021-47778 is a high-severity code injection vulnerability in Get-Simple My SMTP Contact Plugin, published on 21 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
Weakness: CWE-94
Which versions are affected by CVE-2021-47778?
It affects 1 product.
Products include Get-Simple Getsimplecms.
How do I fix CVE-2021-47778?
No fix has been published for CVE-2021-47778 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-47778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47778 exists.
Other vulnerabilities in Get-Simple My SMTP Contact Plugin
Sources
Also known as GHSA-6hw4-fq3j-72w9.