FormFlow for GoHighLevel < 1.0.1 - Unauthenticated Sensitive Data Disclosure via Log File

Description

The plugin does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.