Description

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-07-23T10:16:49.657Z",
  "pubdate": "2026-07-23T10:16:49.657Z",
  "executiveSummary": "The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress, in versions up to and including 1.12.2, is susceptible to an arbitrary file upload vulnerability. This security defect arises from inadequate file type validation within the plugin's codebase, specifically failing to properly verify uploaded file extensions and MIME types against a secure allowlist.\nThe primary impact of this vulnerability is the potential for unauthenticated remote code execution (RCE) on the underlying web server. By exploiting this flaw, an external attacker can bypass standard WordPress upload restrictions and place arbitrary files, such as malicious PHP web shells, directly into web-accessible directories.\nThe affected product is the GoDAM plugin up to version 1.12.2. Exploitation requires network exposure to the vulnerable WordPress instance and involves leveraging the plugin's handling of multipart form data. Successful exploitation grants attackers the capability to execute arbitrary system commands, compromise sensitive data, and gain full administrative control over the affected WordPress installation and its hosting environment, representing a severe risk to organizational security posture.",
  "technicalDetails": "The vulnerability resides in the save_video_file() function within the GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin. This function is hooked into WPForms' public wpforms_process_before_filter action, allowing it to intercept and process incoming HTTP requests containing file uploads prior to standard form processing.\nThe root cause of the vulnerability is insufficient file type validation and an over-reliance on untrusted input. Specifically, the save_video_file() function trusts the attacker-supplied multipart Content-Type header provided in the HTTP request rather than performing robust server-side MIME type verification and cryptographic or extension-based validation. Furthermore, the application preserves the original filename via wp_unique_filename() and moves the raw, unvalidated upload using the $wp_filesystem->move() method directly into a web-served directory.\nThis flawed implementation completely bypasses the security controls enforced by WordPress's core wp_handle_upload() function, which normally implements strict MIME type and extension allowlists. Because the upload routine lacks proper restriction enforcement, unauthenticated attackers can supply a malicious payload, such as a PHP script disguised with a double extension or arbitrary file type, and store it within a publicly accessible directory on the server.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a multipart HTTP POST request containing a malicious payload targeting the endpoint integrated with WPForms. 2) The request triggers the wpforms_process_before_filter hook, executing the vulnerable save_video_file() function. 3) The function extracts the file data, blindly trusts the attacker-controlled Content-Type header, and utilizes wp_unique_filename() to retain the filename structure. 4) The raw file is moved via $wp_filesystem->move() into a web-accessible directory without verifying its extension against a secure allowlist. 5) The attacker accesses the newly uploaded file via a direct HTTP request to execute the embedded code, leading to remote code execution and full compromise of the hosting server."
}