CVE-2025-7441 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 39.8% (pctl 99)
Patch early
A public exploit exists.
Description
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 39.8% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-434 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2025-08-16 |
| Last modified | 2026-06-17 |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload | 2025-08-26 |
References
→ the Explorer · watch your stack · NVD