---
id: CVE-2026-89286
title: >-
  FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure
  via Log File
summary: >-
  The FormFlow for GoHighLevel (GHL)  WordPress plugin through 1.0.0 does not
  restrict access to a log file it writes inside the publicly accessible uploads
  directory, allowing unauthenticated attackers to read its contents, which
  include …
severity: none
cwe:
  - CWE-200
product: FormFlow for GoHighLevel (GHL)
affected:
  - formflow_for_gohighlevel_ghl <= 1.0.0
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T06:00:12.752Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89286'
references:
  - url: 'https://wpscan.com/vulnerability/e564870a-c124-4c11-90ba-907517155cd0/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.596Z'
---

## Overview

The FormFlow for GoHighLevel (GHL)  WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

## Affected

- `formflow_for_gohighlevel_ghl <= 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.