Junglewise Threat Intelligence

CVE-2026-14282: rtcamp GoDAM arbitrary file upload in save_video_file

CVE-2026-14282 · Severity: critical · CVSS 9.8 · Published 2026-07-23

Vendors: rtCamp.

Executive brief

The GoDAM plugin for WordPress, which is used to organize media files and folders, contains a critical security flaw that allows unauthorized users to upload files to the server. An attacker could use this to upload malicious scripts and take full control of the website. This could lead to the theft of customer data, complete site defacement, or the installation of ransomware.

Technical details

The GoDAM plugin for WordPress is vulnerable to unrestricted file uploads due to insufficient validation in the save_video_file() function, which is hooked into the WPForms 'wpforms_process_before_filter'. The vulnerability arises because the function trusts the attacker-supplied multipart Content-Type header and uses $wp_filesystem->move() to place files into a web-accessible directory, bypassing the standard wp_handle_upload() security checks. An unauthenticated attacker can exploit this by sending a specially crafted request to upload a PHP file or other malicious script. This can result in full remote code execution (RCE) on the affected server. The issue affects all versions up to and including 1.12.2.

Affected products

  • rtcamp GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more up to, and including, 1.12.2

Timeline

  • 2026-07-23: disclosed: CVE published by Wordfence and NVD

References