EUVD-2026-16100Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 score of 5.3 (Medium) reflects the vulnerability's network-accessible attack vector (AV:N), low attack complexity (AC:L), and no privilege requirements (PR:N), indicating commodity exploitation tooling can be used. However, the impact is limited to integrity (I:L) with no confidentiality or availability impact, hence the moderate score. Critically, the real-world risk is substantially elevated by several factors: (1) the vulnerability is unauthenticated and pre-authentication, requiring no user interaction (UI:N), making it automatable at scale; (2) the technical impact is high in practice-compromising OAuth credentials grants persistent access to customer data pipelines; (3) the plugin is exposed on every page load via 'plugins_loaded' hook, widening the attack window; (4) WordPress plugins are frequently targeted by opportunistic scanners given WordPress's 43% web server market share. While EPSS data is not provided in this report, the automatable nature and lack of exploitation barriers (no CAPTCHA, rate limiting, or nonce protection documented) suggest exploitation probability is high. The lack of a documented public POC and KEV listing may indicate this vulnerability was recently disclosed, but the simplicity of the attack (triggering an unauthenticated endpoint) means reliable POC code is trivial to develop. Organizations running affected versions should prioritize patching over workarounds, as the integrity impact affects downstream business processes and customer trust. |
| Exploit ScenarioDerived | An attacker sends an unauthenticated HTTP request to a WordPress site running vulnerable FormLift, triggering the connect() method via a page load or direct endpoint call. The method returns a temporary OAuth password in the Location header without checking user authentication. The attacker then makes a second request to listen_for_tokens() with the captured temporary password and attacker-controlled OAuth token values, which are persisted to the WordPress database via update_option(). Subsequent API calls from the FormLift plugin are now routed to the attacker's server, where they can log customer data, inject malicious records, or disrupt CRM automation. No user interaction, valid account, or out-of-band confirmation is required; the exploit completes in two HTTP requests and can be automated across WordPress sites at scale using plugin fingerprinting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The FormLift for Infusionsoft Web Forms WordPress plugin contains a missing authorization vulnerability (CWE-862) that allows unauthenticated attackers to hijack the site's Infusionsoft OAuth connection. Affected versions through 7.5.21 fail to validate user authentication on critical OAuth handler methods, enabling attackers to intercept temporary OAuth credentials and inject arbitrary OAuth tokens and app domains via the update_option() function. This is a network-accessible, low-complexity vulnerability with no required privileges; while the CVSS score is moderate (5.3), the real-world impact is integrity compromise of the CRM integration layer, potentially affecting customer data flows and automation.
RemediationAI
Upgrade the FormLift for Infusionsoft Web Forms plugin to version 7.5.22 or later, which should include capability checks (current_user_can()) on the connect() and listen_for_tokens() methods. Check the official plugin repository or vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a65cc674-a0ea-46b9-b609-b184e1f7ca8e for confirmation of the patched version. Until patching is possible, implement compensating controls: (1) restrict WordPress site access via IP whitelist or Web Application Firewall rules to block unauthenticated requests to the 'plugins_loaded' action if possible; (2) implement nonce verification and additional CSRF tokens on OAuth-related endpoints; (3) audit WordPress site options tables for unauthorized modifications to Infusionsoft connection settings (search for options prefixed with 'infusionsoft' or 'formlift'); (4) monitor Infusionsoft API logs for unexpected API calls from unknown IP ranges. Additionally, consider temporarily disabling the FormLift plugin until a patch is available if the Infusionsoft integration is not critical to operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The FormLift for Infusionsoft Web Forms plugin (cpe:2.3:a:trainingbusinesspros:formlift_for_infusionsoft_web_forms:*:*:*:*:*:*:*:*) integrates WordPress sites with Infusionsoft's CRM platform via OAuth 2.0 authentication. The vulnerability exists in the FormLift_Infusionsoft_Manager class, specifically in two methods: connect() and listen_for_tokens(), both hooked to the 'plugins_loaded' action which executes on every page load. The connect() method initiates OAuth flow and exposes a temporary password in the HTTP Location redirect header without verifying the requester's identity. The listen_for_tokens() method accepts and persists OAuth tokens via WordPress's update_option() function with only temporary password validation-no user capability checks. The root cause falls under CWE-862 (Missing Authorization), a failure to implement access control on sensitive operations. This allows an attacker to manipulate WordPress site options that control Infusionsoft API routing and credentials, potentially redirecting API calls to attacker-controlled infrastructure.
Know when Formlift For Infusionsoft Web Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.
Executive ViewAI
Organizations using for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-4281, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB