The StoryChief WordPress plugin allows unauthenticated users to upload files through the /wp-json/storychief/webhook REST‑API endpoint. This endpoint lacks adequate file‑type validation, creating a CWE‑434 arbitrary file upload flaw that enables an attacker to store arbitrary files on the website’s file system. Uploaded files such as PHP scripts can be executed by a subsequent HTTP request, giving the attacker the ability to run code on the server and fully compromise the site. Based on the description, it is inferred that uploading executable files such as PHP scripts could enable remote code execution.

All installations of the StoryChief plugin for WordPress version 1.0.42 and earlier are affected. The vulnerability resides in the plugin’s REST‑API endpoint and applies to any WordPress site that has the plugin upgraded to these versions.

The CVSS score of 9.8 classifies this as a Critical vulnerability, reflecting the severity of potential remote code execution. The EPSS score of 0.78942 is below the 1 % threshold, indicating a low probability that this flaw will be actively exploited in the wild. It is not listed in the CISA KEV catalog, but the lack of authentication and the ability to upload executable files place this at a very high risk. An attacker only needs network access to the target site to craft a malicious upload request.