Formflow For Gohighlevel Ghl
Monthly
Unauthenticated information disclosure in the FormFlow for GoHighLevel (GHL) WordPress plugin through version 1.0.0 lets anyone who can reach the plugin's log file in the public wp-content/uploads directory read its contents, which include connected-CRM identifiers and, on sites that have linked their GoHighLevel integration, a third-party access token. Because the log is written into a web-served path rather than a protected location, no credentials or user interaction are required - only knowledge or guessing of the file path - so the exposure scales directly with how many affected installs exist and how many operators have completed the CRM link. Publicly available exploit code exists, making path discovery and retrieval straightforward; the practical blast radius is limited mainly by the plugin's small deployment footprint, with the high-confidentiality outcome reserved for integration-linked sites whose token is captured in the log.
Unauthenticated information disclosure in the FormFlow for GoHighLevel (GHL) WordPress plugin through version 1.0.0 lets anyone who can reach the plugin's log file in the public wp-content/uploads directory read its contents, which include connected-CRM identifiers and, on sites that have linked their GoHighLevel integration, a third-party access token. Because the log is written into a web-served path rather than a protected location, no credentials or user interaction are required - only knowledge or guessing of the file path - so the exposure scales directly with how many affected installs exist and how many operators have completed the CRM link. Publicly available exploit code exists, making path discovery and retrieval straightforward; the practical blast radius is limited mainly by the plugin's small deployment footprint, with the high-confidentiality outcome reserved for integration-linked sites whose token is captured in the log.