WPForms Lite Plugin Accused of Installing ‘Backdoor’ During Setup

Image credit: Search Engine Journal

A popular WordPress plugin, WPForms Lite, has been accused of installing a ‘backdoor’ during its setup process, allegedly granting its developer, Awesome Motive, unauthorized administrative access.

The controversy centers on claims that version 2.0.0 of WPForms Lite creates a one-hour login token, enabling Awesome Motive to install and activate additional plugins and potentially access form submissions without explicit user consent.

Sybre Waaijer, a competitor in the SEO plugin market, reported that the setup wizard redirects users from their own sites to WPForms’ servers, where the token is generated. Waaijer stated that his testing confirmed being redirected off-site and observing the automatic installation of WP Mail SMTP, WPConsent, and WPForms Lite.

The alleged ‘backdoor’ could allow Awesome Motive to perform actions typically reserved for a site administrator, according to Waaijer. This includes the ability to install and activate other plugins, which could pose security risks.

However, some members of the WordPress community have disputed the ‘backdoor’ characterization. Marckranat argued that the process requires administrator initiation and does not involve vendor-initiated access, suggesting it is not a true backdoor.

Awesome Motive, led by Syed Balkhi, publishes AIOSEO, while Sybre Waaijer publishes The SEO Framework, placing the two entities in direct competition within the WordPress ecosystem.

The National Institute of Standards and Technology (NIST) defines a backdoor as a method, often secret, of bypassing normal authentication or encryption in a computer system, product, or embedded device. The current debate revolves around whether WPForms Lite’s setup mechanism aligns with this definition.

The accusations have sparked discussion among WordPress users and developers regarding plugin security and the level of access granted to third-party developers during installation processes.

Source: Search Engine Journal