{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/godam---organize-wordpress-media-library--file-manager-with-unlimited-folders-for-images-vid...--1.12.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-14282"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GoDAM - Organize WordPress Media Library \u0026 File Manager with Unlimited Folders for Images, Vid... \u003c= 1.12.2"],"_cs_severities":["critical"],"_cs_tags":["wordpress","arbitrary-file-upload","remote-code-execution","web-exploitation"],"_cs_type":"advisory","_cs_vendors":["GoDAM","WordPress"],"content_html":"\u003cp\u003eCVE-2026-14282 details a critical arbitrary file upload vulnerability affecting the GoDAM - Organize WordPress Media Library \u0026amp; File Manager with Unlimited Folders for Images, Videos \u0026amp; more plugin for WordPress, specifically in versions up to and including 1.12.2. The vulnerability stems from insufficient file type validation within the \u003ccode\u003esave_video_file()\u003c/code\u003e function. This function, which is hooked into WPForms' \u003ccode\u003ewpforms_process_before_filter\u003c/code\u003e, erroneously trusts the attacker-supplied \u003ccode\u003emultipart/form-data\u003c/code\u003e \u003ccode\u003eContent-Type\u003c/code\u003e header. Critically, it bypasses WordPress's standard \u003ccode\u003ewp_handle_upload()\u003c/code\u003e security mechanisms by directly using \u003ccode\u003e$wp_filesystem-\u0026gt;move()\u003c/code\u003e to save the raw uploaded file, while \u003ccode\u003ewp_unique_filename()\u003c/code\u003e preserves the original, potentially malicious, filename. This flaw enables unauthenticated attackers to upload arbitrary files, such as PHP web shells, directly to the web-served directories of the compromised site, leading to potential remote code execution and full system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance\u003c/strong\u003e: An unauthenticated attacker identifies a WordPress site running a vulnerable version of the GoDAM plugin (1.12.2 or earlier).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access (File Upload)\u003c/strong\u003e: The attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e endpoint, which is commonly used by WordPress plugins to handle AJAX actions.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAction Invocation\u003c/strong\u003e: The POST request includes an \u003ccode\u003eaction\u003c/code\u003e parameter (e.g., \u003ccode\u003eaction=gdam_save_video_file\u003c/code\u003e) specifically designed to invoke the vulnerable \u003ccode\u003esave_video_file()\u003c/code\u003e function within the GoDAM plugin.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Payload Delivery\u003c/strong\u003e: The attacker includes a malicious file, such as a PHP web shell, within the \u003ccode\u003emultipart/form-data\u003c/code\u003e body of the request.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBypass and File Placement\u003c/strong\u003e: The \u003ccode\u003esave_video_file()\u003c/code\u003e function, due to its insufficient validation and direct file moving via \u003ccode\u003e$wp_filesystem-\u0026gt;move()\u003c/code\u003e (bypassing \u003ccode\u003ewp_handle_upload()\u003c/code\u003e), saves the malicious file with its original executable extension (e.g., \u003ccode\u003e.php\u003c/code\u003e) to a web-accessible directory on the server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution\u003c/strong\u003e: The attacker then sends a subsequent HTTP GET request directly to the URL of the uploaded web shell, executing arbitrary commands on the compromised WordPress server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The successful execution of arbitrary commands grants the attacker full control over the WordPress instance and potentially the underlying server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14282 allows unauthenticated attackers to upload arbitrary files, including web shells, to a vulnerable WordPress site. This grants remote code execution capabilities, leading to full compromise of the affected website. Attackers can deface the site, inject malicious scripts, steal sensitive data from the database, disrupt website operations, or install backdoors for persistent access. The high CVSS score of 9.8 indicates critical impact and ease of exploitation, making this a severe threat to organizations utilizing the vulnerable plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-14282 immediately by updating the GoDAM WordPress plugin to a version greater than 1.12.2.\u003c/li\u003e\n\u003cli\u003eDeploy the \u003ccode\u003eDetects CVE-2026-14282 Exploitation - GoDAM Plugin Arbitrary File Upload\u003c/code\u003e Sigma rule to your SIEM to identify attempts to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging for HTTP POST requests, including \u003ccode\u003ecs-method\u003c/code\u003e, \u003ccode\u003ecs-uri-stem\u003c/code\u003e, \u003ccode\u003ecs-uri-query\u003c/code\u003e, and \u003ccode\u003erequest_body\u003c/code\u003e if possible, to facilitate detection.\u003c/li\u003e\n\u003cli\u003eReview WordPress server file system permissions to ensure web-accessible directories do not have write permissions for the web server user, if not strictly necessary.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T10:18:58Z","date_published":"2026-07-23T10:18:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-godam-arbitrary-file-upload/","summary":"An arbitrary file upload vulnerability exists in the GoDAM WordPress plugin versions up to and including 1.12.2 due to insufficient file type validation in the `save_video_file()` function, allowing unauthenticated attackers to upload arbitrary files to the server and potentially achieve remote code execution.","title":"GoDAM WordPress Plugin Arbitrary File Upload Vulnerability (CVE-2026-14282)","url":"https://feed.craftedsignal.io/briefs/2026-07-godam-arbitrary-file-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - GoDAM - Organize WordPress Media Library \u0026 File Manager With Unlimited Folders for Images, Vid... \u003c= 1.12.2","version":"https://jsonfeed.org/version/1.1"}