CVE-2026-14282
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
The GoDAM plugin for WordPress up to version 1.12.2 allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution due to insufficient file type validation in the save_video_file() function.
Risk Assessment
An attacker can upload a malicious file (e.g., PHP script) and achieve remote code execution on the server, leading to full site compromise.
Recommendation
Update the GoDAM plugin to the latest patched version.
Original NVD description (English source)
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.