CVE-2021-25094: 
WordPress vulnerability analysis and mitigation

The Tatsu WordPress plugin before version 3.3.12 contained a critical unauthenticated Remote Code Execution (RCE) vulnerability identified as CVE-2021-25094. The vulnerability was discovered in the plugin's addcustomfont action functionality, which could be exploited without prior authentication. This security flaw affected approximately 100,000 websites using the Tatsu Builder plugin (Bleeping Computer, DarkPills).

The vulnerability stems from multiple security weaknesses in the font import feature. An attacker could upload a malicious zip file containing a PHP shell with a filename starting with a dot '.' to bypass the plugin's extension control. Additionally, a race condition in the zip extraction process allowed the shell file to remain accessible on the filesystem long enough to be executed. The vulnerability received a CVSS v3.1 score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allowed remote attackers to execute arbitrary code on servers running outdated versions of the plugin. This could lead to complete server compromise, as the uploaded PHP shell would execute with the web server's privileges. The impact was particularly severe due to the unauthenticated nature of the exploit and the large number of potentially affected websites (Bleeping Computer).

The vulnerability was patched in version 3.3.12 of the Tatsu plugin, released in March 2022. Website administrators were strongly advised to upgrade to this version immediately. The fix primarily involved removing unauthenticated access to the addcustomfont function and implementing additional security checks for file uploads (DarkPills).

The security community responded quickly to the threat, with security firms like Wordfence actively monitoring and blocking exploitation attempts. It was estimated that between 20,000 and 50,000 websites were still running vulnerable versions of the plugin even after the patch was released (Bleeping Computer).