EUVD-2026-47919
GHSA-2cjr-xv2m-jcc3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote upload via a public form path (AV:N/PR:N/UI:N/AC:L) yielding webshell RCE gives full C/I/A impact; scope unchanged as code runs within the WordPress host.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory - bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site.
Technical ContextAI
The vulnerability sits in GoDAM's integration with WPForms, a popular WordPress form-builder plugin. GoDAM registers save_video_file() on WPForms' public wpforms_process_before_filter hook to capture file submissions from a custom video field. Instead of routing uploads through WordPress's canonical wp_handle_upload() - which enforces a MIME-type and extension allowlist and neutralizes dangerous filenames - the code trusts the attacker-controlled multipart Content-Type header, preserves the raw original filename via wp_unique_filename(), and relocates the file with $wp_filesystem->move() into a directory served by the web server. This is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type): validation depends on data the attacker fully controls, so a .php payload declared as video/mp4 lands executable on disk. Affected product per CPE is cpe:2.3:a:rtcamp:godam...:*, i.e. all builds up to and including 1.12.2. The trac source links (class-wpforms-field-godam-video.php around lines 38, 377, 403) pinpoint the vulnerable registration and file-move logic.
RemediationAI
Upgrade GoDAM to the fixed release beyond 1.12.2 as soon as it is available from the WordPress plugin repository; a corrective changeset is referenced upstream (https://plugins.trac.wordpress.org/changeset?reponame=&old=3607513%40godam&new=3607513%40godam), but no specific patched version string was provided in the input, so confirm the exact fixed version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3ae202-1227-4247-9133-5c7284392c9f) before relying on it. If an immediate update is not possible, the highest-value compensating control is to remove or disable any public WPForms form that uses the GoDAM video field, which eliminates the reachable code path at the cost of losing video-upload functionality on those forms. Additional layered controls: configure the web server to deny PHP execution in the plugin's upload/target directory (e.g. an .htaccess or nginx location rule), which blocks code execution even if a file lands but may break legitimately-served media, and deploy a WAF rule (such as Wordfence's) to block malicious multipart uploads to the affected endpoint. Restrict or monitor writable web-served directories for newly created script files.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today