{"id":"CVE-2026-89286","published":"2026-10-19T06:17:25.050","lastModified":"2026-10-19T21:04:50.950","description":"The FormFlow for GoHighLevel (GHL)  WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e564870a-c124-4c11-90ba-907517155cd0/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}