Skip to content
Fencer Vulns
high 8.1

CVE-2021-25094 in the critical feed json

Tatsu < 3.3.12 - Unauthenticated RCE

published 2022-04-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12006

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
83.2%
EPSS 83.2% chance of exploitation in 30 days, percentile 99.6%
public exploits
2
Metasploit, Exploit-DB, plus a Nuclei check

Summary

The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.

Patch / fix

  • brandexponents tatsu 3.3.12

Timeline

  1. First public exploit (Metasploit exploit/multi/http/wp_tatsu_rce)
  2. Published

Exploit prediction

83.23% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/multi/http/wp_tatsu_rce Tatsu Wordpress Plugin RCE metasploit exploit, excellent rank, 2022-04-25
  • EDB-52260 Tatsu 3.3.11 - Unauthenticated RCE webapps, 2025-04-18
  • Nuclei template Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution nuclei detection template
  • wpscan.com https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd referenced PoC, tagged "exploit" by a source, unverified
  • darkpills.com https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/167190/WordPress-Tatsu-Builder-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Unknown Tatsu

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.