Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-14282 EUVD-2026-47919GHSA-2cjr-xv2m-jcc3

GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

Published Jul 23, 2026 · Updated Jul 23, 2026 · Assigned by Wordfence

Vendor: rtcamp Product: GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more Category: Web / CMS

Description

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

VendorProductAffectedFixed
rtcamp GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more ≤ 1.12.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • nullwhisper/CVE-2026-14282 ★ 1 · Aug 13, 2026

    GoDAM WordPress plugin <= 1.12.2 unauthenticated file upload RCE (CVE-2026-14282)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References