The FormLift for Infusionsoft Web Forms plugin contains missing authorization checks in its connect() and listen_for_tokens() methods, which are executed on every page load. Because the plugin generates and leaks an OAuth temporary password without verifying the requesting user, an attacker who can send unauthenticated HTTP requests can trigger the OAuth flow, capture that password, and then use it to write attacker‑controlled OAuth tokens and an app domain into WordPress options. This allows the attacker to redirect the plugin’s API calls to an attacker‑controlled server, effectively hijacking the site's Infusionsoft integration. The weakness is an instance of broken access control (CWE‑862) and results in unauthorized manipulation of third‑party API credentials, exposing the site to data theft or injection.

WordPress sites that have installed the trainingbusinesspros FormLift for Infusionsoft Web Forms plugin in any version up to and including 7.5.21 are affected. The issue is confined to the plugin code; the core WordPress installation is not vulnerable.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. Because no EPSS score is available and the flaw is not listed in the CISA KEV catalog, the likelihood of exploitation cannot be precisely quantified; however, the attack path is simple—unauthenticated HTTP requests to the plugin’s endpoints are sufficient—and the impact on the integration is significant. Given these factors, the risk is considered high relative to the vulnerability’s moderate severity rating, as the hijacked API traffic can expose or corrupt sensitive business data.