CVE-2025-7441
published 2025-08-16CVE-2025-7441: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
37.35%
98.3th percentile
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| storychief | storychief | <= 1.0.42 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated POST requests to the /wp-json/storychief/webhook endpoint, especially those containing a 'featured_image' payload with an external URL in the 'sizes.full' field. ↗
- →The exploit computes an HMAC-SHA256 signature using an empty string as the secret key. Detect webhook requests where the 'mac' field is an HMAC-SHA256 computed with an empty secret. ↗
- →Alert on new PHP files appearing under the WordPress uploads directory (wp-content/uploads/), which may indicate a successfully uploaded webshell via this vulnerability. ↗
- →The plugin uses an empty secret for HMAC validation — any webhook request with a valid HMAC over an empty key should be treated as suspicious and potentially forged. ↗
- →The exploit payload structure includes a JSON body with keys meta.event='publish', meta.mac=<hmac>, and data.featured_image.data.sizes.full=<attacker_url>. Use this structure for WAF/IDS signature creation. ↗
- ·The vulnerability affects all versions of the StoryChief WordPress plugin up to and including 1.0.42. Ensure the version scope is confirmed before applying detections. ↗
- ·The HMAC secret used by the plugin is an empty string, meaning any attacker can forge a valid signature without any prior knowledge or credentials. ↗
- ·The attack is unauthenticated — no WordPress credentials or session tokens are required to exploit this endpoint. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fvp4-h7hv-jq2c: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1
ghsa_unreviewed·2025-08-16
CVE-2025-7441 [CRITICAL] CWE-434 GHSA-fvp4-h7hv-jq2c: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
VulnCheck
Unrestricted Upload of File with Dangerous Type
vulncheck·2025·CVSS 9.8
CVE-2025-7441 [CRITICAL] Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected: StoryChief StoryChief plugin for WordPress
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/story-chief/vulnerability/wordpress-storychief-plugi
No detection rules found.
Exploit-DB
StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
exploitdb·2025-08-26·CVSS 9.8
CVE-2025-7441 [CRITICAL] StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
---
# Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
# Exploit Author: xpl0dec
# Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler
# Software Link: https://github.com/Story-Chief/wordpress/
# Version: ”;
# ?>
# 2. Adjust the echo phpinfo section as needed
# 3. Host it on a VPS/web server with the name you want to upload, for example backdoor.php
# 4. The second argument is the URL of the backdoor created earlier, e.g., http://evil.com/backdoor.php
# 5. Then run the exploit: python3 CVE-2025-7441.py
from datetime import datetime
import requests
import json
import hmac
import hashlib
import sys
import time
import os
def banner():
print(r"""
_ _ ____ _____ _ _ _____ _ __ ____ _ __ __
Metasploit
WordPress StoryChief Plugin Unauthenticated RCE
metasploit
WordPress StoryChief Plugin Unauthenticated RCE
WordPress StoryChief Plugin Unauthenticated RCE
This module exploits an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin <= 1.0.42. The plugin exposes a webhook endpoint at /wp-json/storychief/webhook which accepts a forged HMAC. Because the plugin uses an empty secret for HMAC validation, attackers can compute a valid MAC and force WordPress to download and store attacker-controlled PHP content inside the uploads directory, resulting in remote code execution.
No writeups or analysis indexed.
2025-08-16
Published
Exploited in the wild