StoryChief (WordPress plugin) versions up to and including 1.0.42 expose a critical unauthenticated arbitrary file upload vulnerability via the REST endpoint /wp-json/storychief/webhook. An attacker ...