The GoDAM WPForms integration saved files sent with a WPForms form submission by trusting the client-supplied MIME type and keeping the original file name, moving them into the public uploads/godam/wpforms directory. Unauthenticated visitors could upload PHP or other executable files to the server, which can lead to remote code execution. Sites running GoDAM together with WPForms are at risk.
This vulnerability affects the following application versions:
- GoDAM 1.3.0
- GoDAM 1.3.1
- GoDAM 1.3.2
- GoDAM 1.3.3
- GoDAM 1.3.4
- GoDAM 1.3.5
- GoDAM 1.4.0
- GoDAM 1.4.1
- GoDAM 1.4.2
- GoDAM 1.4.3
- GoDAM 1.4.4
- GoDAM 1.4.5
- GoDAM 1.4.6
- GoDAM 1.4.7
- GoDAM 1.4.8
- GoDAM 1.4.9
- GoDAM 1.5.0
- GoDAM 1.6.0
- GoDAM 1.7.0
- GoDAM 1.7.1
- GoDAM 1.7.2
- GoDAM 1.8.0
- GoDAM 1.9.0
- GoDAM 1.10.1
- GoDAM 1.10.2
- GoDAM 1.11.0
- GoDAM 1.11.1
- GoDAM 1.11.2
- GoDAM 1.12.0
- GoDAM 1.12.1
- GoDAM 1.12.2