CVE-2026-89286
CVE-2026-89286 · FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
CVSS 5.3 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
formflow for gohighlevel (ghl)
- Versiones
- ≥ 0, ≤ 1.0.0: Afectada (semver)
Sin corrección publicada