GoDAM WordPress Plugin Arbitrary File Upload — CVE-2026-14282

Executive Summary

CVE-2026-14282 is a critical unauthenticated arbitrary file upload vulnerability in the GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin. All versions up to and including 1.12.2 are affected. The flaw exists due to insufficient file type validation in the save_video_file() function, which is accessible without authentication. Attackers can upload arbitrary PHP files and achieve remote code execution on the web server.

CVSS score: 9.8 (Critical)

Vulnerability Details

Root Cause

The save_video_file() AJAX handler registered by the GoDAM plugin fails to adequately validate the file type of uploaded content. The function accepts user-supplied file data and writes it to disk without enforcing a safe file extension or MIME type allowlist. Because the endpoint is hooked without an authentication requirement, any unauthenticated visitor can invoke it.

Exploitation

An unauthenticated attacker can send a crafted POST request to the WordPress AJAX endpoint invoking save_video_file() with a PHP webshell as the file payload. Once uploaded to a web-accessible directory, the attacker can request the file directly to execute arbitrary PHP code on the server with the privileges of the web server process.

No credentials, user account, or social engineering is required. This makes the vulnerability trivially weaponizable for automated mass scanning.

Scope

• Affected versions: GoDAM plugin <= 1.12.2
• Authentication required: None
• Attack vector: Network (unauthenticated remote exploitation)
• Impact: Remote code execution, full site compromise, data exfiltration

Impact

Successful exploitation grants an unauthenticated attacker arbitrary code execution on the WordPress hosting server. This typically leads to:

• Webshell installation for persistent access
• Database credential theft via wp-config.php access
• Full site defacement or data exfiltration
• Lateral movement within shared hosting environments
• Use of compromised site for phishing, spam, or malware distribution

Given WordPress's market share, vulnerable GoDAM installations represent a significant attack surface for opportunistic and targeted attacks alike.

Mitigation

Immediate Actions

1. Update to a patched version of the GoDAM plugin — check the WordPress plugin repository for a release newer than 1.12.2. If no patch is available, deactivate and remove the plugin immediately.

2. Audit uploaded files — review your WordPress uploads directory for recently added PHP files or unexpected executables. Remove any suspicious files.

3. Review web server logs — look for POST requests to wp-admin/admin-ajax.php with action=save_video_file or equivalent. Correlate with any subsequent unusual GET requests to the uploads directory.

4. Implement a WAF rule — block requests to AJAX endpoints from unauthenticated users uploading non-media file types as a compensating control.

Longer Term

• Audit all file upload functionality in WordPress plugins for proper authentication checks and file type validation
• Consider a file integrity monitoring (FIM) solution to detect unexpected PHP files in the webroot
• Restrict PHP execution in the uploads directory via .htaccess or server configuration

References

• NVD — CVE-2026-14282
• WordPress Plugin Repository — GoDAM