A critical arbitrary file upload vulnerability in the GoDAM WordPress media plugin lets unauthenticated attackers upload arbitrary files, potentially leading to remote code execution.
What Is It
CVE-2026-14282 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the GoDAM – Organize WordPress Media Library & File Manager plugin, developed by rtcamp. The flaw stems from insufficient file type validation in the plugin's save_video_file() function, which is hooked into WPForms' public wpforms_process_before_filter. The function trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory; bypassing wp_handle_upload()'s MIME/extension allowlist. It is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Why It Matters
The vulnerability is exploitable over the network (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), and requires no user interaction (UI:N). Because the check is bypassable by unauthenticated attackers, an adversary can upload arbitrary files to the affected server, which may make remote code execution possible. The CVSS vector rates confidentiality, integrity, and availability impacts all as HIGH.
What's Vulnerable
- Product: GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more (WordPress plugin)
- Vendor: rtcamp
- Affected versions: All versions up to and including 1.12.2
Patch Status
The supplied source material does not include a CISA KEV entry, so there is no confirmation of active exploitation and no KEV-mandated required action at this time. The NVD record (status: Received) references a plugin changeset associated with the fix but does not state a specific patched version. Administrators should review the referenced Wordfence advisory and vendor changeset and update to a version later than 1.12.2 when available.
Sources
- NVD, CVE-2026-14282: https://nvd.nist.gov/vuln/detail/CVE-2026-14282
- Wordfence Threat Intel: https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3ae202-1227-4247-9133-5c7284392c9f?source=cve
- WordPress plugin changeset: https://plugins.trac.wordpress.org/changeset?reponame=&old=3607513%40godam&new=3607513%40godam