CVE-2026-14282

CVE-2026-14282 in the GoDAM plugin represents a deliberate bypass of WordPress's upload security architecture rather than a simple missed validation check. The vulnerability lives in save_video_file(), which uses $wp_filesystem->move() to place files outside wp_handle_upload()'s protective pipeline. This means GoDAM's developers abandoned WordPress's built-in MIME validation, extension allowlisting, and filename sanitization without implementing replacements—the code preserves original filenames and trusts Content-Type headers directly. The 9.8 CVSS but 0.00671 EPSS gap has a specific explanation: exploitation requires the WPForms plugin to be installed and active, and the wpforms_process_before_filter hook only fires after WPForms completes its own validation (nonce verification, capability checks, form schema validation). In practice, this transforms the vulnerability from 'unauthenticated arbitrary upload' to 'authenticated upload via a specific plugin context.' Automated scanners will flag it, but manual exploitation requires enumerating an existing WPForms form ID and administrative credentials. Check whether GoDAM's image and document handlers follow the same $wp_filesystem->move() pattern—if they do, this is a plugin-wide architectural failure rather than an isolated bug. Also verify the hook priority: if GoDAM registers with lower priority than WPForms's sanitization, certain attack vectors may be blocked conditionally. For defenders, prioritize patching if WPForms is co-installed with GoDAM, and treat the RCE risk as dependent on whether uploaded files land in web-accessible paths—wp_unique_filename() behavior determines whether targeted overwrites are possible.

Reviewed through automated stages and approved by a human before publication.