PT-2026-63589 · Rtcamp · Godam – Organize Wordpress Media Library & File Manager With Unlimited Folders For Images
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save video file() function hooked into WPForms' public wpforms process before filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp unique filename(), and moves the raw upload with $wp filesystem->move() into a web-served directory — bypassing wp handle upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Godam – Organize Wordpress Media Library & File Manager With Unlimited Folders For Images