CVE-2026-14282: GoDAM WordPress Plugin RCE Vulnerability

CVE-2026-14282 Overview

The GoDAM plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 1.12.2. The flaw resides in the save_video_file() function, which is hooked into the public wpforms_process_before_filter action exposed by WPForms. The function trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory. This code path bypasses wp_handle_upload()'s MIME and extension allowlist. Unauthenticated attackers can upload arbitrary files to affected sites, potentially achieving remote code execution [CWE-434].

Critical Impact
Unauthenticated remote attackers can upload executable PHP files to vulnerable WordPress installations, leading to full server compromise through remote code execution.

Affected Products

GoDAM – Organize WordPress Media Library & File Manager plugin for WordPress
All versions up to and including 1.12.2
WordPress sites using GoDAM in combination with WPForms

Discovery Timeline

2026-07-23 - CVE-2026-14282 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-14282

Vulnerability Analysis

The vulnerability is an unauthenticated arbitrary file upload flaw in the GoDAM plugin's WPForms integration. The plugin registers save_video_file() on the wpforms_process_before_filter hook, which processes form submissions before WPForms applies its own validation. Because this hook is reachable by any anonymous visitor submitting a form, no authentication is required to trigger the upload path.

The function accepts multipart form data and reads the client-supplied Content-Type header to determine whether the file is permitted. Attackers control this header directly, so a PHP payload can be uploaded by simply setting the header to video/mp4 while sending a .php file. The plugin then calls wp_unique_filename(), which preserves the attacker's original extension, and writes the file using $wp_filesystem->move() into a directory served by the web server.

By bypassing wp_handle_upload(), the code skips WordPress's built-in MIME and extension allowlist enforcement. The result is a file with an attacker-chosen name and extension placed in a publicly reachable path, which the PHP interpreter will execute on request.

Root Cause

The root cause is improper file type validation. The plugin trusts client-supplied metadata rather than validating the actual file contents server-side. Combined with the decision to preserve the original filename and to skip WordPress's hardened upload handler, the design creates a direct path from anonymous input to code execution.

Attack Vector

Exploitation requires only network access to a WordPress site running a vulnerable GoDAM version with a WPForms form present. An attacker crafts a multipart POST request to the form endpoint, sets Content-Type to a permitted video MIME type, and includes a PHP file as the upload payload. Once the file lands in the web-served directory, the attacker requests it directly to execute arbitrary code as the web server user.

Refer to the Wordfence Vulnerability Analysis and the WordPress Godam Video Class Code for the vulnerable function.

Detection Methods for CVE-2026-14282

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present in the GoDAM or WPForms upload directories under wp-content/uploads/.
Web server access logs showing POST requests to WPForms endpoints followed by GET requests to newly created files with executable extensions.
New files owned by the web server user with modification times matching anonymous form submission traffic.
Outbound network connections initiated by the web server process to unfamiliar hosts after upload activity.

Detection Strategies

Monitor file creation events in WordPress upload directories and alert on any file whose extension is not in an approved media allowlist.
Inspect HTTP request bodies for multipart uploads where the declared Content-Type does not match the file's magic bytes.
Correlate WPForms submission events with subsequent direct requests to newly written files under wp-content/uploads/.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root, with priority on wp-content/uploads/.
Log and retain WPForms submission telemetry, including source IP, referrer, and uploaded filenames.
Alert on PHP execution originating from paths under wp-content/uploads/, which should never contain executable scripts.

How to Mitigate CVE-2026-14282

Immediate Actions Required

Update the GoDAM plugin to a version later than 1.12.2 as soon as a patched release is available from the vendor.
If a patch is not yet installed, disable the GoDAM plugin on all affected WordPress sites.
Audit wp-content/uploads/ for unauthorized script files and remove any that are found.
Rotate WordPress administrative credentials and API keys if evidence of compromise exists.

Patch Information

Refer to the WordPress Godam Changeset for the vendor code changes. Install the fixed plugin release through the WordPress admin interface once available, and verify the plugin version reported by WordPress matches the patched version.

Workarounds

Deactivate the GoDAM plugin until the patched version is deployed.
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules.
Deploy a web application firewall rule to block multipart requests to WPForms endpoints containing PHP file extensions in the filename field.
Restrict access to form pages exposing the vulnerable field to authenticated users where the workflow permits.

bash

# Apache: deny PHP execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|phps)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx: equivalent location block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|phps)$ {
    deny all;
    return 403;
}