High severity7.2NVD Advisory· Published Sep 4, 2025· Updated Jun 17, 2026
CVE-2025-6085
CVE-2025-6085
Description
The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=1.5.10+ 1 more
- (no CPE)range: <=1.5.10
- (no CPE)
Patches
Vulnerability mechanics
References
6- ryankozak.com/posts/cve-2025-6085/nvdExploit
- www.wordfence.com/threat-intel/vulnerabilities/id/c53c322a-b197-4ece-ae4a-a3a86a009e4dnvdThird Party Advisory
- plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.phpnvdProduct
- plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.phpnvdProduct
- plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.phpnvdProduct
- plugins.trac.wordpress.org/changesetnvd
News mentions
0No linked articles in our index yet.