What’s Vulnerable › Vulnerabilities
CVE-2026-89286: FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-19 · updated 2026-10-19
- Weakness: CWE-200
Description
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
Affected products
- FormFlow for GoHighLevel (GHL): through 1.0.0
References
Get alerted when CVE-2026-89286 or the next vulnerability affects your stack