Sybre Waaijer has alleged that Awesome Motive introduced a backdoor in WPForms Lite version 2.0.0, which runs on more than 5 million sites.
According to Waaijer, the backdoor takes over the browser during the setup wizard and opens the plugin on WPForms’ servers. The app receives a one-hour login token for the site, which can be used to install and activate plugins and enable a setting that sends form submissions to WPForms’ servers. Waaijer says this happens automatically for administrators during a fresh installation, without asking for permission or providing a warning.
Following the allegations, WPForms Lite v2.0.3 was released, and the setup wizard now includes a notice informing users that they will be transferred to a WPForms.com site to complete the setup wizard.
What happens during WPForms setup
Waaijer identifies wpforms-lite/src/SetupWizard/Bridge.php as the file containing the code in question.
We took the plugin for a spin and installed it. What we noticed is that once we activate the plugin, we are taken to the “Guided setup wizard”. At this point, we are still on our website.
Note: After the allegations surfaced, we installed the plugin once again and saw a new notice that says, “You will be transferred to a WPForms.com site to complete the setup wizard.”
In the first step, we have moved to – “https://wpformsapi.com/setupwizard/v1/steps/emails”.
This step in the installation process is basically installing another plugin, the WP Mail SMTP by WPForms. We do have the option to skip it.
The next step in the wizard also makes users install another Awesome Motive Plugin, WP Consent, unless users opt out of it from the dropdown.
The next step is setting up Stripe, and after that we get to the last step of the wizard.
By the time we are back on the dashboard, we have two additional plugins we installed. Both of which we could’ve opted out.
Even though we can opt out of installing the additional plugins, the main concern is the wizard opening up in a different URL.
Waaijer also said the application can install and activate plugins from WordPress.org, listing WP Mail SMTP, WPConsent, Uncanny Automator, AIOSEO, Universally, Duplicator, Reviews Feed, OptinMonster, MonsterInsights, and ActiveLayer. The list also includes Contact Form 7, Ninja Forms, and Pirate Forms, which Waaijer says were likely included because of a bug.
He also highlighted how it can retrieve WPForms addons and WPForms Pro from WPForms’ own servers: “They can also pull WPForms addons and WPForms Pro from their own servers. These servers are not moderated and could be used to push malicious code—which ought to be expected, given their track record.”
When Waaijer posted this on X, he also shared a screenshot that appears to show that Syed Balkhi had blocked him on the platform.
Questions raised with the plugins team
The issue was also raised in the #pluginreview Slack channel where Drubonil said he had personally tested the code and claimed that it could install a plugin or external ZIP supplied by the remote server. He asked whether repository plugins are allowed to install remote ZIP files and whether this type of backdoor is permitted in the WordPress plugin repository.
Plugins Team contributor Fernando Torres referred to the WordPress.org plugin guidelines, specifically the section covering executable code sent through third-party systems. He cited the guidelines’ statements that “Externally loading code from documented services is permitted” and “Executing outside code within a plugin when not acting as a service is not allowed.” The guidelines also state that “Management services that interact with and push software down to a site are permitted, provided the service handles the interaction on it’s own domain and not within the WordPress dashboard.”
Torres also said the Plugins Team had not analyzed the WPForms case and therefore could not say whether the behavior qualified as a backdoor or whether it was permitted under the guidelines.
Waaijer subsequently argued that several examples in the guidelines appeared relevant to the behavior he was describing, including installing plugins or add-ons from servers other than WordPress.org and installing premium versions of plugins. He also said WPForms was not the only plugin with mechanisms that can load PHP code from external servers, naming Yoast SEO, WooCommerce, Easy Digital Downloads, and Jetpack.
The Community Response
The allegations prompted a discussion among WordPress developers over whether the behavior described by Waaijer should be considered a backdoor and whether the setup process gives administrators enough information and control.
Katie Keith questioned the use of the term “backdoor,” arguing that the code she reviewed only allows installation from a fixed list of WordPress.org plugins and that those plugins are not necessarily installed on every site. She said the setup wizard has a dedicated step for the plugins and suggested that users may normally choose which ones to install. However, she noted that the relevant part of the wizard is hosted on Awesome Motive’s servers and that she had not verified how the process works.
Waaijer disputed that characterization, pointing to the lack of disclosure about the connection to the company’s servers and the token issued during the process. He also argued that the same token can be used to install and activate WPForms Pro and addons from Awesome Motive’s servers.
Others questioned the “backdoor” description as well. Marinus Klasen called the term “a bit far fetched” but said the behavior was “definitely against guidelines” and “should not be allowed” in the plugin repository.
Iman Zaker similarly said that while “Backdoor” might be arguable, the larger issue was whether administrators clearly consented to the behavior.
Marc Kranat took a different view of the technical characterization, arguing that the behavior does not fit the conventional meaning of a backdoor because it requires a logged-in administrator to trigger the setup wizard and does not involve an authentication bypass or hidden listener.