CVE-2026-89286: FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

Q: Which sites are most exposed to token disclosure?

Any site running the affected plugin can expose connected-CRM identifiers through its publicly accessible log file. Sites that have linked the GoHighLevel integration may also expose a third-party access token in that file.

Q: Does an attacker need an account or user interaction to access the data?

No. The issue is network-accessible and can be exploited without authentication or user interaction if the attacker can retrieve the publicly accessible log file.

Q: How can I determine whether my site may be affected?

Check whether FormFlow for GoHighLevel version 1.0.0 or an earlier version is installed, and whether it writes a log file in the site's publicly accessible uploads directory. If the integration has been linked, treat any token recorded in that log as potentially exposed.

Q: What should be done if a third-party token may have been logged?

Assume the token may have been disclosed and rotate or revoke it through the relevant third-party service. Restrict public access to the affected log file and remove exposed log contents.

Published Oct 19, 2026

Updated

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

Affected Software

1 affected component

FormFlow FormFlow for GoHighLevel<=1.0.0

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are most exposed to token disclosure?

Any site running the affected plugin can expose connected-CRM identifiers through its publicly accessible log file. Sites that have linked the GoHighLevel integration may also expose a third-party access token in that file.

Does an attacker need an account or user interaction to access the data?

No. The issue is network-accessible and can be exploited without authentication or user interaction if the attacker can retrieve the publicly accessible log file.

How can I determine whether my site may be affected?

Check whether FormFlow for GoHighLevel version 1.0.0 or an earlier version is installed, and whether it writes a log file in the site's publicly accessible uploads directory. If the integration has been linked, treat any token recorded in that log as potentially exposed.

What should be done if a third-party token may have been logged?

Assume the token may have been disclosed and rotate or revoke it through the relevant third-party service. Restrict public access to the affected log file and remove exposed log contents.

CVE-2026-89286: FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

Affected Software

Event History

Frequently Asked Questions

Which sites are most exposed to token disclosure?

Does an attacker need an account or user interaction to access the data?

How can I determine whether my site may be affected?

What should be done if a third-party token may have been logged?

Company

Resources

Contact

Frequently Asked Questions

Which sites are most exposed to token disclosure?

Does an attacker need an account or user interaction to access the data?

How can I determine whether my site may be affected?

What should be done if a third-party token may have been logged?