CVE-2026-14282

Name of the Vulnerable Software and Affected Versions GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more versions prior to 1.12.3

Description Insufficient file type validation in the save video file() function, which is hooked into the public wpforms process before filter, allows unauthenticated attackers to upload arbitrary files to the server. The issue occurs because the function trusts the attacker-supplied multipart Content-Type header, preserves the original filename using wp unique filename(), and moves the raw upload via $wp filesystem->move() into a web-served directory, thereby bypassing the MIME and extension allowlist of wp handle upload(). This flaw may enable remote code execution.

Recommendations Update the plugin to a version later than 1.12.2. As a temporary workaround, restrict access to the save video file() function until the update is applied.