CVE-2026-14282 is a critical vulnerability in the GoDAM – Organize WordPress Media Library & File Manager plugin (up to and including version 1.12.2). The issue arises from the save_video_file() function, which is hooked into WPForms' public wpforms_process_before_filter. This function improperly trusts the multipart Content-Type header supplied by attackers, preserves the original filename using wp_unique_filename(), and moves the uploaded file directly into a web-accessible directory using $wp_filesystem->move(), bypassing wp_handle_upload()'s MIME and extension allowlist. As a result, unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution on the affected server.

An unauthenticated attacker can upload arbitrary files to the affected WordPress site, bypassing standard file type restrictions. This can lead to remote code execution, complete site compromise, and potential further exploitation of the hosting environment. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's upload functionality and consider disabling or removing the plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.