The GoDAM WordPress plugin allows unauthenticated users to upload arbitrary files through the WPForms file upload field. The vulnerability stems from insufficient validation in the save_video_file() function, which trusts the multipart Content-Type header and preserves the original filename, then moves the file to a web‑accessible directory without applying the standard MIME and extension allowlist. This flaw permits attackers to upload malicious files, potentially leading to remote code execution on the site.

WordPress sites running the GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin, versions up to and including 1.12.2. The issue is specific to the plugin’s integration with WPForms.

With a CVSS score of 9.8 this vulnerability is categorized as critical. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. Attackers can exploit it by submitting a crafted file through any public WPForms form that uses the GoDAM file upload field, without needing authentication.