An unauthenticated arbitrary file upload vulnerability in the GoDAM WordPress plugin allows attackers to achieve remote code execution on the underlying server.

This flaw involves an unrestricted file upload vulnerability in the save_video_file function, which fails to properly validate file types or extensions. This allows unauthenticated attackers to bypass security filters and upload malicious files directly to the web server.

Successful exploitation allows an unauthenticated attacker to gain full remote code execution capabilities on the affected WordPress server. This leads to total system compromise, including the potential for data exfiltration, unauthorized administrative access, and the deployment of persistent backdoors, which poses a severe risk to organizational operations and data integrity. The CVSS score of 9.8 reflects the critical nature of this vulnerability.

Immediate Action: Update the GoDAM plugin to version 2.0.0 or later immediately.

Proactive Monitoring: Review web server access logs for anomalous file upload requests or attempts to access unexpected file types in media directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads or suspicious POST requests targeting the plugin's video processing functions.

Public Exploit Available: Unknown

Given the critical severity and the potential for complete system compromise, administrators must prioritize updating the GoDAM plugin to the patched version. If an immediate update is not feasible, consider disabling the plugin until a patch can be applied to mitigate the risk of remote code execution.