External risk intelligence

GoDAM WordPress Plugin Arbitrary File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14282

This vulnerability affects a WordPress plugin that implements functionality via public-facing web forms. Because the vulnerable code is reachable through unauthenticated web requests to the site's front-end, it is exposed by design as part of the normal operation of a public-facing web application.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin that allows for arbitrary file uploads. This issue could potentially enable attackers to execute their own code on affected servers, posing a significant security risk. The main concern is to confirm if this specific plugin is in use and assess the potential exposure.

Attackers can upload harmful files.
Protects against unauthorized code execution.
Verify plugin use; assess risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by uploading arbitrary files to the web server. This is possible because the plugin fails to properly validate file types when processing uploads through a specific function. Successful exploitation could allow an attacker to execute arbitrary code on the server.

No authentication required.
Uploads files via a vulnerable function.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload arbitrary files to a WordPress site's server. This is possible because the affected plugin does not sufficiently validate file types when processing uploads through a specific function, bypassing security checks and moving the uploaded file to a web-accessible directory.

Server files could be at risk.
Unauthenticated file uploads could occur.
Remote code execution may be possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts WordPress sites using the GoDAM plugin. Owners of WordPress sites and their associated application or infrastructure teams should first identify all instances of the plugin, confirm its accessibility from the internet, and determine its business criticality to prioritize remediation efforts.

WordPress site owners should own the issue.
Verify plugin accessibility and business impact.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GoDAM WordPress plugin?

GoDAM is a WordPress plugin designed to organize media libraries and manage files, such as images and videos, using custom folder structures. It integrates with other tools like WPForms to handle media uploads. Users rely on it to streamline how assets are stored and categorized within their WordPress dashboard, effectively serving as an extension to the platform's native file handling capabilities.

How does CVE-2026-14282 work?

This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It occurs because the plugin fails to verify the actual file type being uploaded, relying instead on data provided by the user. By trusting the request headers, the plugin allows files to bypass standard security checks and saves them into a directory accessible by web browsers, which can potentially lead to the execution of malicious code on the server.

What triggers this file upload vulnerability?

An attacker triggers this by submitting a specially crafted upload request to the site's public-facing forms. Because the plugin's code processes these requests without strictly validating the file extension or MIME type, it will save almost any file provided. Note that this bug is not triggered by standard administrator actions in the backend; rather, it is accessible via the plugin's integration with public web forms that do not require user authentication.

Is my site relevant to this CVE?

According to Halo Surface Signal, this vulnerability is particularly relevant if your WordPress site uses the GoDAM plugin and exposes forms to the internet. Because the vulnerable function is designed to handle web-based uploads, the entry point is reachable by anyone browsing your site. If your instance is internet-facing, it is considered accessible by design for this specific flaw, making it a priority to check your current plugin version.

How should I respond to this threat?

Begin by auditing your WordPress environment to determine if the GoDAM plugin is installed and active. If you find the plugin, check your version number to see if it falls within the affected range. Prioritize sites that are public-facing, as these carry the highest risk. If you cannot update to a patched version immediately, consider disabling the plugin functionality or removing the plugin entirely to eliminate the risk of arbitrary file uploads.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.