CVE-2025-7441
CRITICAL EXPLOITEDStoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload via Webhook REST-API Endpoint
Title source: llmExploitation Summary
CVE-2025-7441 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 6 public exploits from researchers including xpl0dec, AnotherSec, Boshe99, including a Metasploit module exploits/multi/http/wp_plugin_story_chef_file_upload.
AI-analyzed exploit summary This exploit leverages an arbitrary file upload vulnerability in the StoryChief WordPress plugin (CVE-2025-7441) by crafting a malicious JSON payload with a forged HMAC signature to upload a PHP backdoor via the plugin's webhook endpoint. The backdoor is then accessible in the WordPress uploads directory.
Description
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (6)
This exploit leverages an arbitrary file upload vulnerability in the StoryChief WordPress plugin (CVE-2025-7441) by crafting a malicious JSON payload with a forged HMAC signature to upload a PHP backdoor via the plugin's webhook endpoint. The backdoor is then accessible in the WordPress uploads directory.
This repository contains a functional Python exploit for CVE-2025-7441, an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin. The exploit crafts a malicious JSON payload to trigger server-side file fetching and persistence in the WordPress uploads directory.
The repository contains functional exploit code for CVE-2025-7441, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.
This repository contains a functional Python exploit for CVE-2025-7441, targeting a WordPress webhook vulnerability. The exploit crafts a malicious payload to include a remote shell via the 'featured_image' field and sends it to the vulnerable endpoint.
This repository contains a functional Python exploit for CVE-2025-7441, an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin. The exploit crafts a malicious JSON payload with a remote file URL, computes an HMAC signature, and sends it to the vulnerable endpoint to trigger server-side file retrieval and storage.
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin (CVE-2025-7441). It leverages a forged HMAC due to an empty secret, allowing attackers to upload and execute malicious PHP code via the webhook endpoint.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H