Tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin.
Tracked as CVE-2021-25094 (CVSS score of 8.1), the vulnerability exists because one of the supported actions does not require authentication when uploading a zip file that is extracted under the WordPress upload directory.
While the plugin includes an extension control, this can be bypassed by adding a PHP shell with a filename that begins with a dot (“.”). Furthermore, a race condition in the extraction process allows for an attacker to call the shell file.
The security hole impacts both free and premium versions of Tatsu Builder, a proprietary plugin not available in the official WordPress repository, but which is estimated to have between 20,000 and 50,000 installations.
Although Tatsu sent an urgent email notification to its users in early April, at least a quarter of all installations are believed to still be vulnerable.
Affecting all Tatsu Builder versions prior to 3.3.13, the vulnerability can be exploited by remote, unauthenticated attackers to execute code on vulnerable installations.
Starting May 10, threat actors were observed probing WordPress websites in search of vulnerable iterations of the plugin, with the attacks reaching a peak of 5.9 million attempts per day on May 14.
The attackers cast a wide net, targeting roughly 1.4 million websites on that day, according to WordPress security firm Defiant. While still ongoing, the attack volume has declined.
“Most of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin,” Defiant says.
The company, which also published indicators of compromise (IoCs) associated with this campaign, says that most of the observed attacks originated from a handful of IP addresses, with as few as three IP addresses being used to attack more than one million sites each.
On vulnerable sites, the attackers would deploy a dropper capable of downloading malware to a randomly-named subfolder. The dropper is deployed as a hidden file, Defiant explains.
Tatsu Builder version 3.3.13 contains a full patch for the vulnerability (a partial fix was included in version 3.3.12) and users are advised to update to this version as soon as possible.
Related: Critical Vulnerability in Elementor Plugin Impacts Millions of WordPress Sites
Related: Vulnerability in UpdraftPlus Plugin Exposed Millions of WordPress Site Backups
Related: WordPress 5.8.3 Patches Several Injection Vulnerabilities