GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
CVSS v3
9.8
CRITICAL
EPSS Score
1.3%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw uplo
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw uplo
Active exploitation of CVE-2026-14282 has not been confirmed. The EPSS score is 1.3%, indicating the estimated probability of exploitation in the next 30 days.
CVE-2026-14282 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string 3.1.
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.