Sybre Waaijer, publisher of the rival SEO Framework plugin, alleged on X that WPForms Lite, the free tier of a widely installed WordPress form builder, gives its maker administrative access to more than five million sites through a hidden setup step. Waaijer’s company competes directly with WPForms Lite’s maker, Awesome Motive, which also publishes the AIOSEO plugin against Waaijer’s own product, a rivalry he acknowledged in his posts. Search Engine Journal did not stop at the allegation. Reporter Roger Montti installed the plugin himself to see what actually happens during setup.
Waaijer’s claim centers on a file he identified as wpforms-lite/src/SetupWizard/Bridge.php, added in version 2.0.0. According to his account, the plugin’s onboarding wizard hands Awesome Motive’s servers a one-hour access token during a fresh install, without asking the administrator first. He said that token lets the company’s systems install and activate plugins, and he listed thirteen by name, including AIOSEO, OptinMonster and MonsterInsights, alongside a handful of competing form plugins he called likely an error. He also said the wizard can switch on forwarding of a site’s form submissions to WPForms’ own servers.
Waaijer cited NIST’s definition of a backdoor, an undocumented way of gaining system access, to justify the label. X user marckranat disputed that framing, arguing the word does the heavy lifting: nothing here lets the vendor initiate access on its own, no login step is bypassed, and no hidden listener runs in the background. The wizard only activates once an administrator who is already signed in opens it. That distinction is the crux of the dispute: a backdoor implies access nobody authorized, while a triggered wizard is a setup step an administrator technically allowed, even without knowing its full scope.
Search Engine Journal’s reporting includes no comment from Awesome Motive on either the token or Waaijer’s characterization of it. The only defense quoted came from a third party, X user BuildInBits, who called Awesome Motive a trusted, decade-tested developer and suggested the dispute belonged in a private conversation, not a public post. Waaijer rejected that framing and pointed to the AIOSEO rivalry. He also accused WPBeginner, which he described as part of Awesome Motive’s broader network, of steering readers toward Awesome Motive products while deactivating competitors, including his own.
Montti’s own install supplied the piece’s most concrete finding. He set up WPForms Lite on a site he manages and moved through a wizard he does not recall deliberately entering. Partway through, he noticed the browser’s address bar showed a different domain than the one he had started on, with no notice that a handoff had happened. The features screen pre-checked two boxes, AI Form Generation and Privacy Compliance, with no way to untick them, while a payments option could be declined. The same screen disclosed that the free WPConsent plugin would also install, again with no opt-out. By the final screen, three plugins had gone live on the site: WPForms Lite itself, plus WPConsent and WP Mail SMTP. When Montti tried to repeat the process to reproduce the redirect, it did not happen again.
Montti concluded the token’s likely purpose, importing data and installing companion plugins, is not malicious and is common among plugin setup flows, even as he called the experience of being moved off his own site without noticing it “weird.”
For a search team, the unresolved word choice matters less than the confirmed mechanics: a plugin running on more than five million sites can redirect an administrator off their own domain and install additional software with no opt-out, and Search Engine Journal reproduced that behavior once in a live test. Any site running WPForms Lite should check for WPConsent, WP Mail SMTP or other plugins it did not knowingly approve, and treat an undisclosed setup redirect as a change-control gap to close on its own terms, independent of how the backdoor question gets settled.
Search Engine Journal, reported by Roger Montti, published August 11, 2026.
