This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Unauthenticated Remote Code Execution (RCE) via unrestricted file upload. ๐ **Consequences**: Attackers upload malicious ZIP files (fonts) to execute arbitrary OS commands on the server.โฆ
๐ก๏ธ **CWE**: CWE-306 (Missing Authentication for Critical Function). ๐ **Flaw**: The `add_custom_font` API endpoint allows uploading unverified ZIP files without prior authentication.โฆ
๐ฆ **Product**: WordPress Plugin **Tatsu Builder**. ๐ **Affected**: Versions **<= 3.3.11**. ๐ **Scope**: WordPress sites using this specific page builder plugin.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: Unauthenticated access (No login needed). ๐ป **Action**: Execute arbitrary OS commands (RCE). ๐ **Data**: Read/Write server files, install backdoors, pivot to internal networks.
Q5Is exploitation threshold high? (Auth/Config)
โก **Threshold**: **LOW**. ๐ซ **Auth**: None required. ๐ **Config**: Only requires the plugin to be installed and active. ๐ฏ **Ease**: Automated scripts available for instant exploitation.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฅ **Exploit**: **YES**. ๐ **PoCs**: Multiple public exploits on GitHub (e.g., `CVE-2021-25094-tatsu-preauth-rce`). ๐ก **Wild**: Active exploitation detected; 100,000+ sites at risk.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for `wp-admin/admin-ajax.php` with `action=add_custom_font`. ๐ **Tools**: Use Nuclei templates (`CVE-2021-25094.yaml`). ๐ต๏ธ **Verify**: Check if plugin version is <= 3.3.11.
Q8Is it fixed officially? (Patch/Mitigation)
๐ก๏ธ **Fix**: **YES**. ๐ฅ **Patch**: Update Tatsu Builder to version **3.3.12** or later. โ **Status**: Official vendor release addresses the authentication gap.
Q9What if no patch? (Workaround)
๐ง **Workaround**: Disable the plugin if not in use. ๐ซ **Block**: Restrict access to `admin-ajax.php` via WAF rules. ๐ **Limit**: Prevent unauthenticated POST requests to font upload endpoints.