Elementor Contact Form DB < 1.6 - Plugin Settings Cross-Site Request Forgery

The plugin lacked CSRF nonces, which could allow attackers to make logged in administrators perform unwanted actions, such as change the plugin’s settings via a CSRF attack.