Introduction
Attackers can gain remote code execution on WordPress sites running StoryChief simply by uploading a malicious file to a public API endpoint. With over 1,000 active installations, this vulnerability in a content automation plugin exposes a significant portion of the WordPress ecosystem to full compromise.
About StoryChief: StoryChief is a content marketing and distribution platform that streamlines publishing across multiple channels, including WordPress. Its WordPress plugin automates content delivery and is widely used by marketing teams and agencies. The plugin's REST API integration is central to its workflow automation features.
Technical Information
CVE-2025-7441 is an arbitrary file upload vulnerability in the StoryChief WordPress plugin, affecting all versions up to and including 1.0.42. The vulnerability is present in the REST API endpoint /wp-json/storychief/webhook, which is intended to receive content and media files for automated publishing. The core issue is insufficient filetype validation in the endpoint's file upload handler.
When a request is made to /wp-json/storychief/webhook, the handler processes uploaded files without restricting file extensions or MIME types. This allows an unauthenticated attacker to craft a POST request with a malicious file (for example, a PHP web shell) as multipart form data. The file is then stored in a web-accessible directory, and the attacker can execute arbitrary code by accessing the uploaded file directly via HTTP.
The vulnerable code is located in includes/tools.php at line 75, as referenced in the public plugin repository:
https://plugins.trac.wordpress.org/browser/story-chief/trunk/includes/tools.php#L75
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). No authentication is required to exploit this endpoint, making exploitation trivial and highly scalable.
Affected Systems and Versions
- Product: StoryChief WordPress plugin
- Affected versions: All versions up to and including 1.0.42
- Vulnerable configuration: Any WordPress installation with the StoryChief plugin enabled and the REST API endpoint
/wp-json/storychief/webhookaccessible
Vendor Security History
- Previous vulnerability: Cross-site scripting in version 1.0.30 (see Acunetix advisory), patched in 1.0.31
- No evidence of rapid patch response or mature security lifecycle in public records
- Recurring security issues in file and input handling