# CVE-2026-14282: rtcamp GoDAM arbitrary file upload in save_video_file

Source: https://junglewise.ai/threats/cve-2026-14282-rtcamp-godam-arbitrary-file-upload-in-save-video-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-14282 · Severity: critical · CVSS 9.8 · Published 2026-07-23

The GoDAM plugin for WordPress, which is used to organize media files and folders, contains a critical security flaw that allows unauthorized users to upload files to the server. An attacker could use this to upload malicious scripts and take full control of the website. This could lead to the theft of customer data, complete site defacement, or the installation of ransomware.

Vendors: [rtCamp](https://junglewise.ai/threats/vendors/rtcamp).

## Quick answers

**Is CVE-2026-14282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14282 being exploited in the wild.

**How severe is CVE-2026-14282?** Critical severity, with a CVSS score of 9.8, published 23 July 2026.

**Which products and versions are affected?** rtCamp GoDAM up to, and including, 1.12.2.

**Is there a fix for CVE-2026-14282?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14282 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14282?** Check whether you run rtCamp GoDAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GoDAM plugin for WordPress is vulnerable to unrestricted file uploads due to insufficient validation in the save_video_file() function, which is hooked into the WPForms 'wpforms_process_before_filter'. The vulnerability arises because the function trusts the attacker-supplied multipart Content-Type header and uses $wp_filesystem->move() to place files into a web-accessible directory, bypassing the standard wp_handle_upload() security checks. An unauthenticated attacker can exploit this by sending a specially crafted request to upload a PHP file or other malicious script. This can result in full remote code execution (RCE) on the affected server. The issue affects all versions up to and including 1.12.2.

## Affected products

- rtcamp GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more up to, and including, 1.12.2

## Timeline

- 2026-07-23: disclosed: CVE published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.11.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php](https://plugins.trac.wordpress.org/browser/godam/tags/1.12.2/inc/classes/wpforms/class-wpforms-field-godam-video.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3607513%40godam&new=3607513%40godam](https://plugins.trac.wordpress.org/changeset?reponame=&old=3607513%40godam&new=3607513%40godam)