Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites. The file: wpforms-lite/src/SetupWizard/Bridge.php. What it does: It takes over your browser and opens their app on WPForms' servers. It hands that app a one-hour login token for your site. Their app can then act on your behalf on your site. What they can do with it: Their app can install and activate plugins. It can also turn on a switch that starts sending your form submissions to WPForms' servers. The plugin never asks first and never warns you. When it runs: It kicks in automatically on a fresh install during setup, only for administrators. You won't get a notice. The token expires at the end of setup, or after an hour. What they can install: Thirteen plugins from WordPress dot org: WP Mail SMTP, WPConsent, Uncanny Automator, AIOSEO, Universally, Duplicator, Reviews Feed, OptinMonster, MonsterInsights, ActiveLayer. Oddly (probably a bug), also Contact Form 7, Ninja Forms, and Pirate Forms. They can also pull WPForms addons and WPForms Pro from their own servers. These servers are not moderated and could be used to push malicious code—which ought to be expected, given their track record. Extra context: Awesome Motive is employing and has hired WordPress Plugins Team members.