FormFlow for GoHighLevel CVE-2026-89286

Exploitation requires that the FormFlow for GoHighLevel plugin (version ≤1.0.0) be installed and that its log file be reachable in the publicly served wp-content uploads directory; the attacker must know or guess the log file path. CRM identifiers leak against any affected install, but the high-value third-party access token is ONLY present when the site operator has actively linked/connected the GoHighLevel integration - unlinked sites expose less. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so default reachable configurations of affected sites are exploitable; the primary limiting factors are the plugin's small deployment footprint and the integration-linked precondition for token exposure.

This is a moderate-severity information-disclosure flaw (CWE-200) whose real-world priority is bounded but non-trivial. The NVD CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N (score 5.3) confirms remote, unauthenticated, no-interaction access against a network-reachable file, which is the easiest exploitation profile; publicly available exploit code exists (reported by WPScan), lowering the effort barrier. However, the signals are mixed: there is no CISA KEV listing and no EPSS value in the provided data, so there is no evidence of active or widespread exploitation - only that it is technically trivial. NVD scored confidentiality as C:L, but the described payload includes a third-party CRM access token, which in my independent assessment warrants a higher confidentiality/scope impact because the leaked token enables compromise of a separate system (the connected GoHighLevel CRM); this divergence should be verified against the WPScan advisory. The key moderating factor is footprint and conditionality: the plugin is niche, and the most damaging data (the access token) only leaks on sites that have actually linked the integration. Net: a credible, low-effort data-leak worth prompt patching on affected sites, but not a broad emergency given limited deployment and no confirmed exploitation.

An unauthenticated attacker locates the FormFlow log file written into the site's publicly accessible WordPress uploads directory and requests it directly over HTTP, with no login or user interaction required. The returned contents expose connected-CRM identifiers and, on sites that have linked the GoHighLevel integration, a third-party access token that the attacker can then replay against the CRM. Public exploit code exists (WPScan), so weaponization is straightforward against vulnerable installs.