Vulnerability · Published Jan 21, 2026 · Assigned by VulnCheck

CVE-2021-47830GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF

Medium 5.1

In plain English

A medium-severity cross-site request forgery in My SMTP Contact Plugin from GetSimple CMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not directly enable remote code execution.

Affected products (as reported)

Vendor	Product	Versions
GetSimple CMS	My SMTP Contact Plugin	1.1.1

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

ExploitDB-49774 exploit
ExploitDB-49798 exploit
GetSimple CMS Webpage product
GetSimple CMS GitHub Repository product
VulnCheck Advisory: GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF third-party-advisory