CVE-2026-89286
Received Received - Intake

FormFlow for GoHighLevel Log File Exposure Vulnerability

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-89286
EUVD
EUVD-2026-104086

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown FormFlow for GoHighLevel (GHL) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sensitive data disclosure issue in the FormFlow for GoHighLevel WordPress plugin. It allows unauthenticated attackers to access a log file stored in the public uploads directory. The log contains connected-CRM identifiers and, if the integration is linked, a third-party access token.

Detection Guidance

Check the WordPress uploads directory for suspicious log files named related to FormFlow or GHL. Look for files in paths like /wp-content/uploads/ that may contain CRM identifiers or access tokens. Review server access logs for unauthorized requests to the uploads directory.

Impact Analysis

Attackers could exploit this to steal sensitive data like CRM identifiers and access tokens. This could lead to unauthorized access to connected systems, data breaches, or further attacks on your WordPress site or third-party integrations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties or fines.

Mitigation Strategies

Update the FormFlow for GoHighLevel plugin to version 1.0.1 or later immediately. If updating is not possible, restrict access to the uploads directory via server configuration (e.g., .htaccess rules or web server permissions) to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart