The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-7441 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted request to the /wp-json/storychief/webhook endpoint without authentication. By bypassing filetype validation, the attacker can upload malicious files to the server, potentially leading to remote code execution.
Affected Products
- StoryChief Plugin for WordPress (all versions up to 1.0.42): Vulnerable to arbitrary file uploads due to insufficient filetype validation.
Mitigation
To mitigate this vulnerability, it is recommended to update the StoryChief plugin to the latest version where the file upload validation has been properly implemented. Additionally, server configurations should be reviewed to restrict file uploads and ensure proper security measures are in place.