CVE-2021-47830
GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jan 21, 2026
- Updated
- Apr 7, 2026
- Reserved
- Jan 14, 2026
Description
GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not directly enable remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
My SMTP Contact PluginGetSimple CMS |
|
References
- ExploitDB-49774exploit
- ExploitDB-49798exploit
- GetSimple CMS Webpageproduct
- GetSimple CMS GitHub Repositoryproduct
- VulnCheck Advisory: GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRFthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.