CVE-2021-47778

CVE-2021-47778 identifies a PHP code injection vulnerability within GetSimple CMS My SMTP Contact Plugin version 1.1.2, enabling an authenticated administrator to inject arbitrary PHP code through plugin configuration parameters. This critical flaw can lead to remote code execution on the server. Rated 7.2 HIGH, the vulnerability has a network attack vector and low attack complexity, but requires high privileges for exploitation, resulting in high impacts to confidentiality, integrity, and availability. There is no evidence of active exploitation, it is not in CISA's KEV catalog, and no public exploit code is available on common platforms, though there are community discussions primarily on GitHub.