Arbitrary File Upload in WordPress Make Connector plugin upload_media

Successful exploitation allows an authenticated Administrator-level attacker to upload arbitrary files to the server hosting the vulnerable WordPress site. If the uploaded file is executable in the target environment, the attacker may achieve remote code execution. This can result in full compromise of the WordPress application and potentially the underlying server context available to the web process, including modification of site content, deployment of persistent backdoors, theft of sensitive data, and further post-exploitation activity.

If an updated version is not immediately available, disable the Make Connector plugin or restrict its use until a fix can be applied. Limit Administrator access to trusted users only, enforce strong authentication and MFA for privileged WordPress accounts, and monitor for suspicious uploads. Configure the web server to prevent execution of uploaded files in media or upload directories where possible, and use file integrity monitoring to detect unauthorized file placement.

Update the Make Connector plugin to a version newer than 1.5.10 once a vendor fix is available. The vulnerable condition affects all versions up to and including 1.5.10. Review the plugin's file upload handling to ensure strict server-side allowlisting of permitted file types, validation of file extensions and MIME types, and prevention of executable file placement in web-accessible locations. Audit uploaded files and administrative activity for signs of abuse.