Arbitrary File Upload Vulnerability in Make Connector Plugin for WordPress

CVE-2025-6085

What is CVE-2025-6085?

The Make Connector plugin for WordPress is susceptible to arbitrary file uploads due to insufficient validation of file types in its 'upload_media' function. Authenticated users with Administrator-level access can exploit this vulnerability to upload malicious files to the server, potentially allowing for remote code execution. This poses a significant risk, as attackers could gain unauthorized access to the server and its resources.

References