Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Large-Scale Attack Targeting Tatsu Builder WordPress Plugin

Tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin.

Tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin.

Tracked as CVE-2021-25094 (CVSS score of 8.1), the vulnerability exists because one of the supported actions does not require authentication when uploading a zip file that is extracted under the WordPress upload directory.

While the plugin includes an extension control, this can be bypassed by adding a PHP shell with a filename that begins with a dot (“.”). Furthermore, a race condition in the extraction process allows for an attacker to call the shell file.

The security hole impacts both free and premium versions of Tatsu Builder, a proprietary plugin not available in the official WordPress repository, but which is estimated to have between 20,000 and 50,000 installations.

Although Tatsu sent an urgent email notification to its users in early April, at least a quarter of all installations are believed to still be vulnerable.

Affecting all Tatsu Builder versions prior to 3.3.13, the vulnerability can be exploited by remote, unauthenticated attackers to execute code on vulnerable installations.

Starting May 10, threat actors were observed probing WordPress websites in search of vulnerable iterations of the plugin, with the attacks reaching a peak of 5.9 million attempts per day on May 14.

The attackers cast a wide net, targeting roughly 1.4 million websites on that day, according to WordPress security firm Defiant. While still ongoing, the attack volume has declined.

Advertisement. Scroll to continue reading.

“Most of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin,” Defiant says.

The company, which also published indicators of compromise (IoCs) associated with this campaign, says that most of the observed attacks originated from a handful of IP addresses, with as few as three IP addresses being used to attack more than one million sites each.

On vulnerable sites, the attackers would deploy a dropper capable of downloading malware to a randomly-named subfolder. The dropper is deployed as a hidden file, Defiant explains.

Tatsu Builder version 3.3.13 contains a full patch for the vulnerability (a partial fix was included in version 3.3.12) and users are advised to update to this version as soon as possible.

Related: Critical Vulnerability in Elementor Plugin Impacts Millions of WordPress Sites

Related: Vulnerability in UpdraftPlus Plugin Exposed Millions of WordPress Site Backups

Related: WordPress 5.8.3 Patches Several Injection Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

Wendi Whitmore has taken the role of Chief Security Intelligence Officer at Palo Alto Networks.

Phil Venables, former CISO of Google Cloud, has joined Ballistic Ventures as a Venture Partner.

David Currie, former CISO of Nubank and Klarna, has been appointed CEO of Vaultree.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.