{"id":"CVE-2021-25094","aliases":["EUVD-2021-12006","GHSA-grmv-gp4f-w59q"],"status":"published","title":"Tatsu \u003c 3.3.12 - Unauthenticated RCE","description":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \".\", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.83232,"percentile":0.99684,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306","CWE-434"],"published":"2022-04-25T15:50:46Z","modified":"2026-06-17T03:41:27Z","exploits":[{"source":"exploitdb","id":"EDB-52260","title":"Tatsu 3.3.11 - Unauthenticated RCE","type":"webapps","platform":"php","date":"2025-04-18","url":"https://www.exploit-db.com/exploits/52260"},{"source":"metasploit","id":"exploit/multi/http/wp_tatsu_rce","title":"Tatsu Wordpress Plugin RCE","type":"exploit","platform":"PHP","date":"2022-04-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_tatsu_rce"},{"source":"nuclei","id":"CVE-2021-25094","title":"Wordpress Tatsubuilder \u003c= 3.3.11 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25094.yaml"},{"source":"pocgithub","id":"TUANB4DUT/typehub-exploiter","title":"TUANB4DUT/typehub-exploiter","date":"2022-07-10","url":"https://github.com/TUANB4DUT/typehub-exploiter"},{"source":"pocgithub","id":"darkpills/CVE-2021-25094-tatsu-preauth-rce","title":"darkpills/CVE-2021-25094-tatsu-preauth-rce","date":"2022-01-03","url":"https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce"},{"source":"pocgithub","id":"experimentalcrow1/TypeHub-Exploiter","title":"experimentalcrow1/TypeHub-Exploiter","date":"2023-03-18","url":"https://github.com/experimentalcrow1/TypeHub-Exploiter"},{"source":"pocgithub","id":"xdx57/CVE-2021-25094","title":"xdx57/CVE-2021-25094","date":"2022-07-10","url":"https://github.com/xdx57/CVE-2021-25094"}],"products":[{"vendor":"brandexponents","product":"tatsu"},{"vendor":"unknown","product":"tatsu"}],"references":[{"url":"https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167190/WordPress-Tatsu-Builder-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/52260"},{"url":"https://packetstorm.news/files/id/190566/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25094"},{"url":"https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094"},{"url":"https://packetstorm.news/files/id/190566"},{"url":"https://github.com/advisories/GHSA-grmv-gp4f-w59q"}],"sources":{"cve":[{"id":"CVE-2021-25094","title":"Tatsu \u003c 3.3.12 - Unauthenticated RCE","description":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \".\", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.","status":"published","published":"2022-04-25T15:50:46Z","modified":"2025-04-21T15:04:51.317Z","cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-12006","description":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \".\", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.","status":"published","published":"2022-04-25T15:50:46Z","modified":"2025-04-21T15:04:51Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-grmv-gp4f-w59q","title":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior...","description":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \".\", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.","status":"published","published":"2022-04-26T00:00:39Z","modified":"2025-04-21T15:32:17Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-306","CWE-434"],"updated_at":"2026-11-02T15:01:58.520974Z"}],"nvd":[{"id":"CVE-2021-25094","description":"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot \".\", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.","status":"published","published":"2022-04-25T16:16:07.117Z","modified":"2026-06-17T03:41:27.09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:07:06.029737Z"}]}}