Introduction
Attackers can gain remote code execution on WordPress sites running StoryChief simply by uploading a malicious file to a public API endpoint. The plugin has over 1,000 active installations, and any of them running a vulnerable version is open to full compromise.
StoryChief is a content marketing and distribution platform that publishes content across multiple channels, including WordPress. Its WordPress plugin automates content delivery and is widely used by marketing teams and agencies. The plugin's workflow automation is built around its REST API integration.
Technical Information
CVE-2025-7441 is an arbitrary file upload vulnerability in the StoryChief WordPress plugin, in all versions up to and including 1.0.42. It sits in the REST API endpoint /wp-json/storychief/webhook, which exists to receive content and media files for automated publishing. The root cause is insufficient file type validation in the endpoint's upload handler.
The handler accepts files sent to /wp-json/storychief/webhook without restricting file extensions or MIME types. An unauthenticated attacker can send a POST request with a malicious file, such as a PHP web shell, as multipart form data. The plugin stores the file in a web-accessible directory, and the attacker runs arbitrary code by requesting that file directly over HTTP.
The vulnerable code is at line 75 of includes/tools.php in the public plugin repository:
https://plugins.trac.wordpress.org/browser/story-chief/trunk/includes/tools.php#L75
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Exploiting the endpoint requires no authentication, so the attack is trivial to carry out and easy to run at scale.
Affected Systems and Versions
- Product: StoryChief WordPress plugin
- Affected versions: All versions up to and including 1.0.42
- Vulnerable configuration: Any WordPress installation with the StoryChief plugin enabled and the REST API endpoint
/wp-json/storychief/webhookaccessible
Vendor Security History
- Previous vulnerability: Cross-site scripting in version 1.0.30 (see Acunetix advisory), patched in 1.0.31
- Public records show no evidence of a rapid patch response or a mature security lifecycle
- Security issues recur in file and input handling
