PT-2025-33527 · WordPress · Storychief

Michael Mazzolini · Published 2025-08-16 · Updated 2026-02-20 · CVE-2025-7441

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: StoryChief plugin for WordPress versions up to and including 1.0.42

Description: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filetype validation. This occurs through the /wp-json/storychief/webhook REST-API endpoint, allowing unauthenticated attackers to upload arbitrary files to the affected server. This may lead to remote code execution.

Recommendations: Update the StoryChief plugin to a version later than 1.0.42.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-7441

Affected Products

Storychief

References · 13

• 🔥 https://exploit-db.com/exploits/52422 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7441 · Security Note
• https://twitter.com/VulmonFeeds/status/1956594096153211359 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1raahs5/metasploit_wrapup_02202026 · Reddit Post
• https://twitter.com/Nxploited/status/1976687670068650123 · Twitter Post
• https://twitter.com/Nxploited/status/1975537416606998571 · Twitter Post
• https://plugins.trac.wordpress.org/browser/story-chief/trunk/includes/tools.php#L75 · Note
• https://plugins.trac.wordpress.org/changeset/3344874 · Note
• https://t.me/CVEtracker/30174 · Telegram Post
• https://twitter.com/CveFindCom/status/1956569177457602925 · Twitter Post
• https://twitter.com/cracbot/status/1958484271108124840 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/979efaa4-10f1-4c7f-b4b0-5a41678c9d66?source=cve · Note
• https://twitter.com/CVEnew/status/1956654785794552140 · Twitter Post