📄 Tatsu 3.3.11 Remote Code Execution

Tatsu versions 3.3.11 and below pre-authentication proof of concept remote code execution exploit. !/usr/bin/python3 coding: utf-8 Exploit Title:Tatsu = 3.3.11 pre-auth RCE exploit Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H:...

Tatsu 3.3.11 - Unauthenticated RCE

Exploit Title:Tatsu 3.3.11 - Unauthenticated RCE Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Product: Tatsu wordpress plugin = 3.3.11 CVE:...

WordPress Tatsu Plugin Remote Code Execution (CVE-2021-25094)

A remote code execution vulnerability exists in WordPress Tatsu plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2021-25094

creationtimestamp| type| source ---|---|--- 2022-05-17 12:00:22+00:00| exploited| https://t.me/BleepingComputer/12075 2022-05-18 11:40:39+00:00| exploited| https://t.me/truesecator/2952 2022-05-18 13:16:30+00:00| exploited| https://t.me/itsecnews/668 2022-05-18 17:34:04+00:00| exploited|...

Millions of Attacks Target Tatsu Builder Plugin

The Wordfence Threat Intelligence team has been tracking a large-scale attack against a Remote Code Execution vulnerability in Tatsu Builder, which is tracked by CVE-2021-25094 and was publicly disclosed on March 24, 2022 by an independent security researcher. The issue is present in vulnerable...

CVE-2021-25094

The Tatsu WordPress plugin before 3.3.12 addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control...

CVE-2021-25094

CVE-2021-25094 affects the WordPress Tatsu plugin prior to 3.3.12. An unauthenticated attacker can upload a crafted ZIP via add_custom_font, decompose it on the WordPress uploads path, and place a PHP shell (filename starting with a dot) to bypass extension controls. A race condition during ZIP e...

Exploit for Missing Authentication for Critical Function in Brandexponents Tatsu

Preauth RCE in Tatsu builder Wordpress plugin CVE-2021-25094...