CVE-2021-25094 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated Remote Code Execution (RCE) via unrestricted file upload. 📉 **Consequences**: Attackers upload malicious ZIP files (fonts) to execute arbitrary OS commands on the server.…

🛡️ **CWE**: CWE-306 (Missing Authentication for Critical Function). 🔍 **Flaw**: The `add_custom_font` API endpoint allows uploading unverified ZIP files without prior authentication.…

📦 **Product**: WordPress Plugin **Tatsu Builder**. 📅 **Affected**: Versions **<= 3.3.11**. 🌐 **Scope**: WordPress sites using this specific page builder plugin.

👑 **Privileges**: Unauthenticated access (No login needed). 💻 **Action**: Execute arbitrary OS commands (RCE). 📂 **Data**: Read/Write server files, install backdoors, pivot to internal networks.

⚡ **Threshold**: **LOW**. 🚫 **Auth**: None required. 🌐 **Config**: Only requires the plugin to be installed and active. 🎯 **Ease**: Automated scripts available for instant exploitation.

🔥 **Exploit**: **YES**. 📂 **PoCs**: Multiple public exploits on GitHub (e.g., `CVE-2021-25094-tatsu-preauth-rce`). 📡 **Wild**: Active exploitation detected; 100,000+ sites at risk.

🔍 **Check**: Scan for `wp-admin/admin-ajax.php` with `action=add_custom_font`. 📊 **Tools**: Use Nuclei templates (`CVE-2021-25094.yaml`). 🕵️ **Verify**: Check if plugin version is <= 3.3.11.

🛡️ **Fix**: **YES**. 📥 **Patch**: Update Tatsu Builder to version **3.3.12** or later. ✅ **Status**: Official vendor release addresses the authentication gap.

🚧 **Workaround**: Disable the plugin if not in use. 🚫 **Block**: Restrict access to `admin-ajax.php` via WAF rules. 🛑 **Limit**: Prevent unauthenticated POST requests to font upload endpoints.

🔴 **Priority**: **CRITICAL**. 🚨 **Urgency**: Immediate action required. ⚠️ **Reason**: Unauthenticated RCE allows instant full server takeover. 🏃 **Action**: Patch NOW.