Metform Elementor Contact Form Builder < 3.3.3 - Cross-Site Request Forgery

The plugin does not correctly validate nonces on the permalink_setup function. This can potentially enable the alteration of permalink structure via a forged request, if an administrator is tricked into clicking a deceptive link. Verification only takes place when a nonce is provided, leaving the plugin vulnerable to Cross-Site Request Forgery.