Security Experts:

Connect with us

Hi, what are you looking for?



Large-Scale Attack Targeting Tatsu Builder WordPress Plugin

Tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin.

Tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin.

Tracked as CVE-2021-25094 (CVSS score of 8.1), the vulnerability exists because one of the supported actions does not require authentication when uploading a zip file that is extracted under the WordPress upload directory.

While the plugin includes an extension control, this can be bypassed by adding a PHP shell with a filename that begins with a dot (“.”). Furthermore, a race condition in the extraction process allows for an attacker to call the shell file.

The security hole impacts both free and premium versions of Tatsu Builder, a proprietary plugin not available in the official WordPress repository, but which is estimated to have between 20,000 and 50,000 installations.

Although Tatsu sent an urgent email notification to its users in early April, at least a quarter of all installations are believed to still be vulnerable.

Affecting all Tatsu Builder versions prior to 3.3.13, the vulnerability can be exploited by remote, unauthenticated attackers to execute code on vulnerable installations.

Starting May 10, threat actors were observed probing WordPress websites in search of vulnerable iterations of the plugin, with the attacks reaching a peak of 5.9 million attempts per day on May 14.

The attackers cast a wide net, targeting roughly 1.4 million websites on that day, according to WordPress security firm Defiant. While still ongoing, the attack volume has declined.

“Most of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin,” Defiant says.

The company, which also published indicators of compromise (IoCs) associated with this campaign, says that most of the observed attacks originated from a handful of IP addresses, with as few as three IP addresses being used to attack more than one million sites each.

On vulnerable sites, the attackers would deploy a dropper capable of downloading malware to a randomly-named subfolder. The dropper is deployed as a hidden file, Defiant explains.

Tatsu Builder version 3.3.13 contains a full patch for the vulnerability (a partial fix was included in version 3.3.12) and users are advised to update to this version as soon as possible.

Related: Critical Vulnerability in Elementor Plugin Impacts Millions of WordPress Sites

Related: Vulnerability in UpdraftPlus Plugin Exposed Millions of WordPress Site Backups

Related: WordPress 5.8.3 Patches Several Injection Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.