CVE-2026-14282
CRITICAL
CVSS 9.8
godam_organize_wordpress_media_library_file_manager_with_unlimited_folders_for_images_videos_more
Verified Advisory
Unauthenticated arbitrary file upload in GoDAM WordPress plugin (CVE-2026-14282)
WordPress
RCE
File Upload
Wordpress Plugin
Godam Organize Wordpress Media Library File Manager With Unlimited Folders For Images Videos More
Rtcamp
The GoDAM plugin for WordPress contains insufficient file type validation in the `save_video_file()` function, which trusts the attacker-supplied multipart Content-Type header and moves uploads into a web-served directory without invoking `wp_handle_upload()`'s MIME/extension allowlist. Unauthenticated attackers can exploit this to upload arbitrary files to the affected server, potentially achieving remote code execution.
Affected versions:
- <= 1.12.2
We recommend updating to: 2.0.0.
CVSS 9.8 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3ae202-1227-4247-9133-5c7284392c9f?source=cve
Details: https://vuln.today/cve/CVE-2026-14282
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.12.2
Fixed in: 2.0.0