CVE-2026-89286
CVE-2026-89286 · FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
formflow for gohighlevel (ghl)
- Versions
- ≥ 0, ≤ 1.0.0: Affected (semver)
No fix published