Live › vulnerability › CVE-2026-89286
Go to dashboardThe FormFlow for GoHighLevel WordPress plugin writes a log file into the publicly readable uploads directory without access restrictions. An unauthenticated visitor can download it and read CRM identifiers and, on sites that linked the integration, a third-party access token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the FormFlow for GoHighLevel WordPress plugin version 1.0.0 or earlier. The log is only exposed when the plugin writes it to the public uploads directory, and the token is only present on sites that have linked the GoHighLevel integration. Sites without the plugin, or with it removed, can skip this.
No product ranges from the sources yet.
/wp-content/uploads/ on the site (the exact filename is unknown from the sources)1.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
This page as .md · .json · in your agent: get_signal("CVE-2026-89286")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.