GoDAM Unauthenticated Arbitrary File Upload Vulnerability (CVE-2026-14282) Advisory

Vulnerability Overview Vulnerability Name: GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVE ID: CVE-2026-14282 CVSS Score: 9.8 (Critical) Release Date: July 22, 2026 Last Update Date: July 23, 2026 Researcher: CHOIGYEONGMIN Impact Scope Affected Software: GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more Affected Versions: <= 1.12.2 Vulnerability Type: Unauthenticated File Upload Vulnerability Vulnerability Description: The GoDAM plugin, in version 1.12.2 and earlier, contains an unauthenticated file upload vulnerability. This vulnerability arises because the function of WPForms trusts an attacker-supplied multipart Content-Type header, retains the original filename (via ), and saves it directly to the web server directory, thereby bypassing the MIME/extension whitelist checks in . This allows unauthenticated attackers to upload arbitrary files on the affected site, potentially leading to Remote Code Execution (RCE). Remediation Fixed Version: 2.0.0 or higher Remediation Advice: Upgrade to GoDAM plugin version 2.0.0 or higher. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: godam Fixed: Yes Affected Versions: <= 1.12.2 Fixed Version: 2.0.0 Related Vulnerabilities Vulnerability Title: GoDAM <= 1.4.6 - Missing Authorization CVE ID: CVE-2025-67584 CVSS Score: 5.3 Researcher: Oz04k5xd3 Release Date: November 21, 2025 Disclaimer This record contains copyrighted material. Copyright © 2012-2026 Defiant Inc. Copyright © 1999-2026 The MITRE Corporation Contact For any questions or errors, please contact: wfi-support@wordfence.com Business Hours Eastern Time: 9:00 AM to 6:00 PM Pacific Time: 6:00 AM to 5:00 PM UTC/GMT Time: 2:00 PM to 1:00 AM Excludes weekends and holidays Customer Support Response: 24 hours a day, 365 days a year, 1-hour response time Terms of Service Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Products - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support - Documentation - Learning Center - Free Support - Premium Support News - Blog - News - Vulnerability Advisories About - About Wordfence - Affiliate Program - Careers - Contact - Security - CVE Request Form Subscribe for Updates Subscribe to news and updates Email Address Agree to Terms of Service and Privacy Policy Register Copyright Notice © 2012-2026 Defiant Inc. All rights reserved. Others Powered by Cherubic

Goal Reached Thanks to every supporter — we hit 100%!

GoDAM Unauthenticated Arbitrary File Upload Vulnerability (CVE-2026-14282) Advisory

More from this source