CVE-2026-14282
Received Received - Intake

Arbitrary File Upload in GoDAM WordPress Plugin

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Wordfence

Description
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-14282
EUVD
EUVD-2026-47919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmedia godam to 1.12.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the GoDAM WordPress plugin versions up to 1.12.2. It allows unauthenticated attackers to upload arbitrary files to the server by exploiting insufficient file type validation in the save_video_file() function. The plugin trusts attacker-supplied Content-Type headers and moves raw uploads into web-accessible directories, bypassing WordPress's built-in upload restrictions. This could lead to remote code execution.

Detection Guidance

Check for unexpected files in web-served directories, particularly those uploaded via the GoDAM plugin. Review server logs for unusual upload requests to paths associated with the plugin.

Impact Analysis

If exploited, this vulnerability could allow attackers to upload malicious files to your WordPress server. This may result in remote code execution, giving attackers full control over your website. It could also lead to data theft, defacement, or the site being used to distribute malware to visitors.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update the GoDAM plugin to the latest version if available. Disable the plugin if no update is available. Restrict file upload permissions and monitor for unauthorized file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart