What is the CVSS score of CVE-2025-7441?

CVE-2025-7441 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 69.7%.

Which versions of WordPress are affected by CVE-2025-7441?

Organizations using for WordPress is vulnerable to arbitrary file uploads in all face critical risk from CVE-2025-7441, a unrestricted file upload vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2025-7441?

Yes, a public proof-of-concept exploit is available for CVE-2025-7441. Prioritise patching immediately. EPSS: 69.7%.

How to fix or mitigate CVE-2025-7441?

Within 24 hours: Identify all affected systems running for WordPress is vulnerable to arbitrary file uploads in all and apply vendor patches immediately. Review file handling controls and restrict upload directories.

WordPress CVE-2025-7441

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-08-16 security@wordfence.com

WordPress RCE File Upload

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 18:25 vuln.today

Public exploit code

Analysis Generated

Mar 28, 2026 - 19:07 vuln.today

CVE Published

Aug 16, 2025 - 04:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

The StoryChief WordPress plugin through version 1.0.42 contains an unauthenticated arbitrary file upload via the /wp-json/storychief/webhook REST API endpoint. Insufficient file type validation allows attackers to upload executable PHP files, achieving remote code execution on the WordPress server.

Technical ContextAI

The StoryChief plugin registers a webhook REST API endpoint at /wp-json/storychief/webhook that processes content updates from the StoryChief platform. This endpoint accepts file attachments without properly validating file types or authenticating the request source. An attacker can send a crafted webhook payload containing a PHP file that is saved to the WordPress uploads directory.

Affected ProductsAI

StoryChief for WordPress <= 1.0.42

RemediationAI

Update StoryChief plugin to version 1.0.43 or later. Implement webhook signature verification. Restrict webhook endpoint to StoryChief IP ranges. Scan the uploads directory for PHP files.