CVE-2021-3133: 
WordPress vulnerability analysis and mitigation

The Elementor Contact Form DB plugin before version 1.6 for WordPress contained a Cross-Site Request Forgery (CSRF) vulnerability that affected backend admin pages. The vulnerability was discovered and disclosed in January 2021, impacting WordPress installations using this plugin (NVD, WPScan).

The vulnerability was classified as a Cross-Site Request Forgery (CSRF) issue with a CVSS v3.1 base score of 6.5 (Medium). The plugin lacked proper CSRF protection through nonces on its administrative interfaces, which could allow attackers to make logged-in administrators perform unwanted actions, particularly concerning plugin settings modifications (NVD, WPScan).

The vulnerability could allow attackers to trick authenticated administrators into performing unintended actions on the plugin's settings through CSRF attacks. This could potentially lead to unauthorized changes in the plugin's configuration when an administrator visits a malicious page while logged into the WordPress dashboard (WPScan).

The vulnerability required user interaction and could only be exploited if an authenticated administrator visited a maliciously crafted webpage while logged into the WordPress dashboard. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires user interaction (UI:R) (NVD).

The vulnerability was patched in version 1.6 of the Elementor Contact Form DB plugin. Site administrators are strongly advised to update to version 1.6 or later to address this security issue. The update added better handling of backend admin pages to prevent CSRF attacks (WordPress Plugin).