Description
The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Disclosure
Action: Apply Patch
AI Analysis

Impact

The FormFlow for GoHighLevel WordPress plugin fails to restrict access to a log file it writes in the public uploads directory. The log contains connected-CRM identifiers and, if the integration is enabled, a third‑party access token. Without authentication, an attacker can view this information, potentially gaining privileged access to the CRM system. The lack of protection on a publicly accessible file directly leads to a confidentiality breach.

Affected Systems

FormFlow for GoHighLevel (GHL) WordPress plugin, all versions up to and including 1.0.0.

Risk and Exploitability

An unauthenticated attacker can read the log file by requesting its URL, as no permissions are enforced. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the exposure of sensitive tokens makes the risk moderate. The CVSS score of 5.3 reflects moderate severity; however, the disclosed credentials could allow further compromise of the integrated CRM system.

Generated by OpenCVE AI on October 19, 2026 at 13:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FormFlow for GoHighLevel plugin to a version newer than 1.0.0 where the log file is no longer publicly accessible or its contents are sanitized.
  • If an update is not immediately available, configure the web server (e.g., via .htaccess or server blocks) to deny all requests to the uploads directory path that contains the log file.
  • Remove existing log files from the uploads directory or move them to a non‑web‑accessible location after confirming they contain no sensitive data.
  • Ensure that future plugins or custom code follow proper access controls and do not expose log files to unauthenticated users.

Generated by OpenCVE AI on October 19, 2026 at 13:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-532

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-532

Mon, 19 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.
Title FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:19.535Z

Reserved: 2026-09-11T12:10:43.320Z

Link: CVE-2026-89286

cve-icon Vulnrichment

Updated: 2026-10-19T09:22:23.852Z

cve-icon NVD

Status : Received

Published: 2026-10-19T06:17:25.050

Modified: 2026-10-19T10:16:49.757

Link: CVE-2026-89286

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:45:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor