CVE-2026-89286 Details
Description
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
A vulnerability exists in the FormFlow for GoHighLevel WordPress plugin, affecting versions through 1.0.0. The plugin fails to restrict access to a log file it creates in the publicly accessible uploads directory. This oversight allows unauthenticated attackers to read the log file's contents, which include connected CRM identifiers and, for sites that have linked the integration, a third-party access token.
Users are advised to update the FormFlow for GoHighLevel WordPress plugin to version 1.0.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e564870a-c124-4c11-90ba-907517155cd0/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| FormFlow | < 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |