CVE-2025-7441

The StoryChief plugin for WordPress (all versions up to and including 1.0.42) performs insufficient file-type validation on uploads submitted through its /wp-json/storychief/webhook REST-API endpoint (CWE-434). Because the endpoint requires no authentication, any unauthenticated attacker who can reach the site can send crafted requests that place arbitrary files, including PHP files, on the affected server. Uploaded files in web-executable locations can then be run, making remote code execution and full site compromise possible, consistent with the critical CVSS 3.1 score of 9.8. Any WordPress site running an affected version of the StoryChief plugin is exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the high EPSS score (39.5%, 99th percentile) indicates a substantial probability of exploitation within the next 30 days.

What to do: Update the StoryChief plugin immediately to the latest patched release (any version newer than 1.0.42). Until patching, restrict or block unauthenticated access to the /wp-json/storychief/webhook endpoint (e.g., via WAF or web-server rules) and review web-server logs for suspicious POST requests to that endpoint. Also inspect upload directories for unexpected PHP or other executable files that could indicate prior exploitation.