CVE-2026-14282 json
GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
published 3mo ago modified 3mo ago also EUVD-2026-47919
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Is CVE-2026-14282 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- rtcamp GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/ce3ae202-1227-4247-9133-5c7284392c9f?source=cve
- plugins.trac.wordpress.org /browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L38
- plugins.trac.wordpress.org /browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L403
- plugins.trac.wordpress.org /browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L403
- plugins.trac.wordpress.org /browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L377
- plugins.trac.wordpress.org /browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L38
- plugins.trac.wordpress.org /browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php#L377
- plugins.trac.wordpress.org /changeset?reponame=&old=3607513%40godam&new=3607513%40godam
Sources
- CVE List CVE-2026-14282
- NVD CVE-2026-14282
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.