CVE-2026-89286
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
| Vendor | unknown |
| Product | formflow for gohighlevel (ghl) |
| Published | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown formflow for gohighlevel (ghl)
Be the first to know when new unknown vulnerabilities affecting unknown formflow for gohighlevel (ghl) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FormFlow for GoHighLevel (GHL)
0 ≤ 1.0.0
References
Credits
Ehab M.Kandah WPScan