cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line \$url = $config'admin_url' . '/login.php?recoverme=' . $code;\ that can result in Administrator Password Reset Poisoning specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.