CVE-2021-36886: 
WordPress vulnerability analysis and mitigation

CVE-2021-36886 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin affecting versions 1.2.5.9 and earlier. The vulnerability was disclosed on November 12, 2021, and was fixed in version 1.2.6.1 (Patchstack, WordPress).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue with a CVSS v3.1 base score of 8.8 HIGH (NIST) and 6.5 MEDIUM (Patchstack). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This affects the confidentiality, integrity, and availability of the system, all rated as High according to the CVSS metrics (Patchstack).

The recommended mitigation is to update the Contact Form 7 Database Addon – CFDB7 plugin to version 1.2.6.1 or later, which contains the fix for this vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited, but updating is still recommended as a security best practice (Patchstack).