CVE-2025-7441

Think of this like a mailbox slot on your website that's supposed to only accept certain packages, but currently accepts anything — including a package that could let a stranger walk right into your building and take over. Because it requires no password and no clicks from anyone, an attacker can exploit it directly over the internet, potentially gaining full control of the server that runs your site.

This matters to you if you run a WordPress website with the StoryChief plugin installed, in version 1.0.42 or any earlier release. It's a risk for any site where this plugin's REST API endpoint is reachable from the internet — which is the default setup, so most installations are exposed.

This is a critical, red-flag issue: attackers need no account and no user interaction to exploit it, and a detection template already exists, meaning scanning and exploitation attempts can happen at any time. Press attention is rising and no patch exists yet, so acting immediately — disabling the plugin or blocking the vulnerable endpoint — is the only way to reduce risk right now.

Confirm exposure by identifying whether StoryChief is active on any WordPress site and checking the installed version (<=1.0.42 is vulnerable). Because no patched version has been published by the vendor at this time, the only effective mitigations are: (a) deactivate the plugin entirely until a fix ships, or (b) use a web application firewall / server-level rule to block unauthenticated requests to /wp-json/storychief/webhook. If the plugin is business-critical, consider restricting the REST API route to trusted IPs or requiring authentication at the web server layer as a temporary compensating control. Monitor the plugin changelog and WordPress.org plugin page for a security release, and apply it as soon as it's available — re-verify the endpoint's filetype validation post-patch. Also review web server and WordPress upload directories for unexpected file types (e.g., PHP, executables) uploaded since this vulnerability became public, and check access logs for repeated POST requests to the webhook endpoint as an indicator of scanning or exploitation attempts.

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. Weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type) in the /wp-json/storychief/webhook REST-API endpoint, which lacks filetype validation and can lead to remote code execution. Not currently listed in CISA KEV. A detection/scanning template exists in exploit tooling, but no confirmed in-the-wild exploitation has been reported; predictive exploitation-likelihood scoring (EPSS) placed it in the 99th percentile with a falling trend at time of analysis, though this is a prediction, not confirmed activity. No vendor patch is currently available. Press/community attention is rising, increasing the likelihood of opportunistic scanning.