{"id":"CVE-2026-89286","kind":"vulnerability","aliases":["CVE-2026-89286"],"related":[],"title":"FormFlow for GoHighLevel WordPress plugin exposes log file with access token","description":"The FormFlow for GoHighLevel (GHL)  WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.","summary":"The FormFlow for GoHighLevel WordPress plugin writes a log file into the publicly readable uploads directory without access restrictions. An unauthenticated visitor can download it and read CRM identifiers and, on sites that linked the integration, a third-party access token.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gohighlevel","package","self-hosted","wordpress"],"not_affected_if":["no-gohighlevel-integration","plugin-not-installed"],"how_to_check":"- Browse to the plugin's log file under `/wp-content/uploads/` on the site (the exact filename is unknown from the sources)\n- Check the installed plugin version in the WordPress admin plugins list against `1.0.0`\n- Check whether the site has linked the GoHighLevel integration, since that is when a token is written to the log","fix":"- Update or remove the FormFlow for GoHighLevel plugin: fixed version unknown\n- Delete the existing log file from the uploads directory\n- Rotate the GoHighLevel access token if the integration was linked while the log was public","status":"open","published_at":"2026-10-19T06:17:25+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:40+00:00","updated_at":"2026-10-25T04:26:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:26:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update or remove the FormFlow for GoHighLevel plugin: fixed version unknown\n- Delete the existing log file from the uploads directory\n- Rotate the GoHighLevel access token if the integration was linked while the log was public","reach":"internet","title":"FormFlow for GoHighLevel WordPress plugin exposes log file with access token","impact":"medium","summary":"The FormFlow for GoHighLevel WordPress plugin writes a log file into the publicly readable uploads directory without access restrictions. An unauthenticated visitor can download it and read CRM identifiers and, on sites that linked the integration, a third-party access token.","category":"package","nicknames":[],"who_cares":["wordpress","gohighlevel","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads CRM identifiers and a third-party access token","analyst_note":"Find the fixed plugin version and the exact log file path from the NVD entry or the plugin's changelog.","how_to_check":"- Browse to the plugin's log file under `/wp-content/uploads/` on the site (the exact filename is unknown from the sources)\n- Check the installed plugin version in the WordPress admin plugins list against `1.0.0`\n- Check whether the site has linked the GoHighLevel integration, since that is when a token is written to the log","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-gohighlevel-integration"],"who_is_affected":"Sites running the FormFlow for GoHighLevel WordPress plugin version 1.0.0 or earlier. The log is only exposed when the plugin writes it to the public uploads directory, and the token is only present on sites that have linked the GoHighLevel integration. Sites without the plugin, or with it removed, can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":3341,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-89286':14A,17A '1.0.0':74C 'access':10A,41B,64B,78C,88C,116C 'allow':91C 'attack':93C 'connect':101C 'connected-crm':100C 'content':97C 'crm':51B,102C 'cve':12A,15A 'directori':39B,90C 'download':47B 'expos':6A 'file':8A,33B,82C 'formflow':1A,25B,67C 'ghl':70C 'gohighlevel':3A,18B,27B,69C 'host':22B 'identifi':52B,103C 'includ':99C 'insid':85C 'integr':59B,111C 'link':57B,109C 'log':7A,32B,81C 'packag':19B 'parti':63B,115C 'plugin':5A,29B,72C 'public':36B,87C 'read':50B,95C 'readabl':37B 'restrict':42B,77C 'self':21B 'self-host':20B 'site':55B,106C 'third':62B,114C 'third-parti':61B,113C 'token':11A,65B,117C 'unauthent':44B,92C 'upload':38B,89C 'visitor':45B 'without':40B 'wordpress':4A,23B,28B,71C 'write':30B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FormFlow for GoHighLevel WordPress plugin version 1.0.0 or earlier. The log is only exposed when the plugin writes it to the public uploads directory, and the token is only present on sites that have linked the GoHighLevel integration. Sites without the plugin, or with it removed, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89286","severity":null,"published_at":"2026-10-19T06:17:25+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}