CVE-2026-89286 FormFlow CVE debrief

Who should care

Defenders of WordPress sites using the FormFlow for GoHighLevel (GHL) plugin should assess exposure and verify log file access controls. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, security teams and vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-89286 allows unauthenticated attackers to read sensitive information from log files written by the FormFlow for GoHighLevel (GHL) WordPress plugin. Defenders of WordPress sites using this plugin should assess exposure, verify log file access controls, and restrict access to the uploads directory. The impact is limited to reading log file contents; no code execution or data modification is reported. Remediation priority is moderate; verify plugin version and restrict log file access.

• Unauthenticated attackers can read log file contents containing connected-CRM identifiers and third-party access tokens.

Technical summary

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents. This log file contains connected-CRM identifiers and, on sites that have linked the integration, a third-party access token. The issue is limited to reading log file contents; no code execution or data modification is reported. The plugin writes the log file in a publicly accessible directory without proper access controls.

Defensive priority

Assess exposure and verify log file access controls.

Recommended defensive actions

• Verify that the FormFlow for GoHighLevel (GHL) WordPress plugin version is not 1.0.0 or earlier.
• Restrict access to the log file written by the plugin in the uploads directory.
• Monitor for unauthorized access to the log file.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 writes a log file in the publicly accessible uploads directory without access restrictions, allowing unauthenticated attackers to read its contents.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.