CVE-2021-25094

What it actually does

CVE-2021-25094 is an unauthenticated arbitrary file upload leading to remote code execution in the Tatsu WordPress plugin before version 3.3.12. The vulnerable add_custom_font action accepts a ZIP archive without requiring authentication, extracts it under the WordPress uploads directory, and can be bypassed by placing a PHP web shell inside the archive with a filename beginning with a dot. A race condition during extraction leaves the PHP file present long enough for an attacker to call it over HTTP, allowing execution of attacker-supplied PHP code in the context of the web server process.

Why it matters to the business

A vulnerable public WordPress site can be taken over remotely without valid credentials. Successful exploitation may allow attackers to modify website content, steal data stored or accessible by WordPress, install persistent backdoors, redirect visitors, host malware, abuse the server for spam or phishing, and pivot into connected infrastructure. The high EPSS score and weaponized exploit maturity indicate a materially elevated likelihood of internet-scale exploitation, especially for externally reachable WordPress installations running the affected plugin.

How an attack unfolds

An attacker first identifies a WordPress site running a vulnerable version of the Tatsu plugin. They then send an unauthenticated request to the plugin’s custom-font upload action, supplying a malicious ZIP archive. The archive contains a PHP payload whose filename starts with a dot, allowing it to bypass the plugin’s extension filtering logic. During ZIP extraction, the payload is written into the WordPress uploads directory. Because of the race condition, the attacker quickly requests the newly created PHP file before it is removed or blocked, causing the server to execute the payload. From there, the attacker can run commands with web server privileges, upload additional web shells, modify WordPress files, create unauthorized administrator users, exfiltrate configuration data, or establish persistence.

How to fix it

Upgrade the Tatsu WordPress plugin to version 3.3.12 or later. If an update is not immediately available, disable and remove the plugin until it can be updated. Restrict direct execution of PHP files from WordPress upload directories using web server configuration, because uploads should not need to execute server-side code. Review filesystem permissions so the web server account cannot write executable code outside required upload/cache locations. Remove suspicious hidden PHP files from upload directories only after preserving forensic evidence. Consider placing WordPress behind a web application firewall rule that blocks unauthenticated requests invoking the add_custom_font action.

How to confirm the fix worked

Confirm the installed Tatsu plugin version is 3.3.12 or later by checking the WordPress admin plugin page or the plugin metadata in wp-content/plugins/tatsu. Verify that the site no longer accepts unauthenticated requests to wp-admin/admin-ajax.php with action=add_custom_font. Inspect web server configuration to confirm PHP execution is disabled in wp-content/uploads and its subdirectories. Search the uploads tree for hidden PHP files, recently created PHP files, unexpected ZIP extraction directories, and web shells. Review access logs for historical unauthenticated POST requests to admin-ajax.php involving add_custom_font followed by HTTP GET requests to hidden .php files under wp-content/uploads.

Typical attack path

1. Scan public websites for WordPress installations using the Tatsu plugin.
2. Determine whether the plugin version is older than 3.3.12 or attempt the exploit opportunistically.
3. Send an unauthenticated POST request to the WordPress AJAX endpoint invoking the add_custom_font action.
4. Upload a crafted ZIP archive containing a hidden PHP payload whose filename begins with a dot.
5. Trigger the race window by immediately requesting the extracted PHP file under the WordPress uploads directory.
6. Use the resulting PHP code execution to run commands, deploy a more stable web shell, alter WordPress content, or create persistence.
7. Clean up obvious artifacts or continue post-exploitation activity such as credential theft, spam injection, phishing redirects, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, WAF logs, endpoint telemetry, and WordPress file integrity data. Look for unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=add_custom_font, especially when followed within seconds by GET requests to hidden PHP files under /wp-content/uploads/. Inspect multipart upload requests carrying ZIP files from unknown IP addresses. On disk, search the WordPress uploads directory for hidden files beginning with a dot and ending in .php, recently created PHP files, suspicious ZIP extraction folders, or web shells with functions such as eval, assert, system, shell_exec, passthru, base64_decode, gzinflate, or preg_replace with executable behavior. Review WordPress user tables through supported administrative tooling for newly created administrator accounts, check plugin/theme files for unexpected modifications, and examine web server process activity for command execution spawned by PHP. If centralized logs are available, correlate exploit-like requests with outbound network connections, file writes, new cron jobs, or changes to wp-config.php and other WordPress application files.

• /wp-admin/admin-ajax.php
• action=add_custom_font
• POST /wp-admin/admin-ajax.php
• /wp-content/uploads/
• /wp-content/uploads/.
• /wp-content/uploads/.*\.php
• /wp-content/uploads/.*/\.[^/]+\.php
• filename="*.zip"
• Content-Disposition: form-data
• wp-content/plugins/tatsu
• add_custom_font
• \.php
• base64_decode(
• shell_exec(
• passthru(
• system(
• eval(
• assert(
• gzinflate(

What your security team should do

• Immediately inventory internet-facing WordPress sites for the Tatsu plugin and prioritize any version older than 3.3.12.
• Upgrade Tatsu to 3.3.12 or later, or disable/remove the plugin where it is not required.
• Add or verify web server controls that prevent PHP execution from wp-content/uploads.
• Hunt across web access logs for unauthenticated requests containing action=add_custom_font and follow-on requests to hidden PHP files in upload paths.
• Perform filesystem triage of affected sites, focusing on hidden PHP files, recently modified WordPress core/plugin files, suspicious administrator accounts, and unexpected scheduled tasks or cron jobs.
• Rotate WordPress administrator credentials, database credentials, and any secrets stored in wp-config.php if exploitation is suspected.
• Deploy WAF/SIEM detections for exploit attempts against wp-admin/admin-ajax.php using the add_custom_font action.
• If compromise is confirmed, rebuild from a known-good backup or clean image rather than relying only on deleting the visible shell.