CVE-2021-25094: Tatsu WordPress plugin unauthenticated zip upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability, though not yet in CISA KEV.

What it is

The Tatsu WordPress plugin before 3.3.12 exposes the add_custom_font action without authentication, allowing an attacker to upload a zip that is extracted into the WordPress uploads directory. A PHP shell named with a leading dot bypasses the plugin's extension check, and a race condition in extraction keeps the file callable long enough to execute.

Impact

An unauthenticated attacker can execute arbitrary PHP on the server, leading to full site compromise, data theft, and use of the host for further attacks.

Attack surface

Reachable over the network via the plugin's add_custom_font action; no authentication or user interaction is required per the CVSS vector (PR:N/UI:N).

Exploitation

Public exploit code is referenced (Packet Storm, Exploit-DB, WPScan, vendor writeup) and EPSS is 0.83354 (99.7th percentile), though CISA KEV does not list it.

What to do

• Update the Tatsu plugin to version 3.3.12 or later immediately.
• If patching is not possible, disable or remove the Tatsu plugin until it can be updated.
• Restrict write and execute permissions in the WordPress uploads directory and block PHP execution there via web server configuration.
• Monitor and clean any unexpected dot-prefixed files in the uploads directory.
• Apply a WAF rule to block unauthenticated requests to the add_custom_font action.

Detection

• Search the WordPress uploads directory for dot-prefixed .php files or recently extracted zip contents.
• Monitor web server logs for POST requests to admin-ajax.php or plugin endpoints with the add_custom_font action from unauthenticated sources.
• Alert on PHP execution attempts from files within the uploads directory.
• Review file integrity monitoring for new PHP files in uploads paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.