27 matches found
CVE-2025-7441
CVE-2025-7441 StoryChief 1.0.42 - Subida de archivos arbitraria Vulnerabilidad CVE-2025-7441 - Resumen técnico Componente afectado: Plugin StoryChief para WordPress Tipo de vulnerabilidad: Subida de archivos arbitraria no autenticada Endpoint vulnerable: /wp-json/storychief/webhook Causa raíz: El...
CVE-2025-7441
CVE-2025-7441 StoryChief data - sizes - full field pointing to an arbitrary URL. StoryChief does not perform sufficient filetype/content validation or restrict the URL source, allowing the plugin to fetch the remote resource and save it under the site's uploads directory. There is insufficient...
Metasploit Wrap-Up 02/20/2026
Hacking Churches and Backdooring Emacs This release packs some solid exploit module additions! Two new unauthenticated RCE modules are a major win: the StoryChief WordPress plugin exploit CVE-2025-7441 targets a webhook validation flaw allowing arbitrary file uploads, while the ChurchCRM exploit...
📄 WordPress StoryChief 1.0.42 Shell Upload
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in the StoryChief WordPress plugin less than or equal to 1.0.42. The plugin exposes a webhook endpoint at /wp-json/storychief/webhook which accepts a forged HMAC. Because the plugin uses an empty secret for HMA...
📄 WordPress StoryChief 1.0.42 Remote Code Execution
A critical security vulnerability exists in WordPress Story Chief plugin version 1.0.42 that allows unauthenticated attackers to achieve remote code execution by exploiting the webhook featured image functionality...
Exploit for CVE-2025-7441
CVE-2025-7441 StoryChief - 1.0.42 - Unauthenticated Arbitrary...
Exploit for CVE-2025-7441
CVE-2025-7441 StoryChief = 1.0.42 - Unauthenticated Arbitr...
EUVD-2025-25062
Malicious code in bioql PyPI...
StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload Exploit Author: xpl0dec Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler Software Link: https://github.com/Story-Chief/wordpress/ Version: ”; ? 2. Adjust the echo phpinfo section as needed 3. Host it o...
📄 WordPress StoryChief 1.0.42 Shell Upload
WordPress StoryChief plugin versions 1.0.42 and below suffer from a remote shell upload vulnerability. Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload Exploit Author: xpl0dec Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler Software Link:...
WordPress Plugin StoryChief File Upload Vulnerability
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin StoryChief file upload vulnerability , the vulnerability stems from the...
CVE-2025-7441
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
CVE-2025-7441
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
CVE-2025-7441 StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
CVE-2025-7441
The CVE-2025-7441 issue affects WordPress StoryChief/plugin versions up to 1.0.42. It centers on an unauthenticated, arbitrary file upload via the /wp-json/storychief/webhook endpoint, which lacks sufficient file-type validation, enabling an attacker to store attacker-controlled content (e.g., PH...
CVE-2025-7441 StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
CVE-2025-7441: Unrestricted Upload of File with Dangerous Type
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
PT-2025-33527
Name of the Vulnerable Software and Affected Versions: StoryChief plugin for WordPress versions up to and including 1.0.42 Description: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filetype validation. This occurs through the...
WordPress plugin StoryChief 代码问题漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin StoryChief file upload vulnerability , the vulnerability stems from the...
WordPress StoryChief plugin <= 1.0.42 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by mikemyers in WordPress Plugin StoryChief versions = 1.0.42...