The FormLift for Infusionsoft Web Forms plugin suffers from missing authorization checks in the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class. Both methods are hooked to the 'plugins_loaded' action and run on every page load without verifying user authentication or authorization. The connect() method generates an OAuth connection password and leaks it in the redirect Location header without validating the requester. The listen_for_tokens() method validates only the temporary password but does not authenticate the user before calling update_option() to save OAuth tokens and the app domain. This flaw enables unauthenticated attackers to hijack the OAuth connection by first triggering the OAuth flow to get the temporary password, then using it to set arbitrary OAuth tokens and redirect API communication to an attacker-controlled server.

An unauthenticated attacker can hijack the Infusionsoft OAuth connection of the affected WordPress site by manipulating OAuth tokens and the app domain stored by the plugin. This can redirect API communications to an attacker-controlled server, potentially allowing the attacker to intercept or manipulate data exchanged with the Infusionsoft service. The vulnerability does not impact confidentiality directly but results in integrity loss of the OAuth tokens and API communication. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider disabling the FormLift for Infusionsoft Web Forms plugin or restricting access to the affected methods if possible. Monitor vendor channels for updates and apply official patches promptly once released.