Overview
A significant security flaw has been discovered in the Make Connector plugin for WordPress. This vulnerability allows an attacker, who already has administrator-level access or higher, to upload harmful files to your website’s server. Essentially, this means a compromised admin account could be used to take complete control of your WordPress site by executing malicious code. This is a serious issue because it bypasses the normal security checks that prevent unauthorized file types from being uploaded.
CVE Details
- Product: Make Connector plugin for WordPress
- CVE ID: CVE-2025-6085
- Published Date: September 4, 2025
- Severity: High (CVSS Score 7.2)
- Status: Analyzed
Affected Products
The vulnerability impacts all versions of the Make Connector plugin for WordPress up to, and including, version 1.5.10.
Current Status
This vulnerability has been formally analyzed and documented. While the issue stems from an oversight in how the plugin handles file uploads before validating them, the good news is that the community and developers are aware. Users of the affected plugin should take immediate action to protect their sites.
Severity Level
Rated as ‘High’ with a CVSS score of 7.2, this vulnerability carries significant risk. The ability for an authenticated attacker (meaning someone with an administrator account) to upload arbitrary files is a direct path to remote code execution. If exploited, an attacker could potentially deface your website, steal sensitive data, or even inject malware, leading to a complete compromise of your server.
Possible Solutions
The most critical step is to update your Make Connector plugin. Since the vulnerability affects all versions up to and including 1.5.10, it is imperative to upgrade to a version *higher* than 1.5.10 as soon as a patched version is officially released by the developers. Always check the official WordPress plugin repository or the developer’s website for the latest secure version.
In the meantime, if an immediate update is not available, consider these mitigation strategies:
- Disable the Plugin: If the functionality of the Make Connector plugin is not critical for your website operations, consider temporarily deactivating it until a patch is released and applied.
- Principle of Least Privilege: Ensure that only trusted personnel have Administrator-level access to your WordPress site. Regularly review user roles and permissions, revoking any unnecessary high-level access.
- Security Monitoring: Implement robust security monitoring for your WordPress site to detect any unusual file uploads or suspicious activity on your server.
References
https://github.com/d0n601/CVE-2025-6085
https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L24
https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L74
https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L90-95
https://ryankozak.com/posts/cve-2025-6085/
https://www.wordfence.com/threat-intel/vulnerabilities/id/c53c322a-b197-4ece-ae4a-a3a86a009e4d?source=cve
