{"vulnerability": "cve-2021-25094", "sightings": [{"uuid": "55a80c51-2094-4d0c-acee-f6b15b0913c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsu3fzr5xm2c", "content": "", "creation_timestamp": "2025-06-30T21:02:21.698720Z"}, {"uuid": "f9f545f2-372a-4b7f-845a-457fb5eae794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ln6ztjgo7b2a", "content": "", "creation_timestamp": "2025-04-19T21:02:15.951695Z"}, {"uuid": "467dbaac-73c6-420b-8a67-379e6d5e9224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:59.000000Z"}, {"uuid": "fd2d43b4-7c16-45e6-9cdf-82d13b931169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_tatsu_rce.rb", "content": "", "creation_timestamp": "2025-06-29T14:45:21.000000Z"}, {"uuid": "41283ed5-6efb-4f67-a339-dbbc2fb60f20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/BleepingComputer/12075", "content": "Latest news and stories from BleepingComputer.com\nHackers target Tatsu WordPress plugin in millions of attacks\n\nHackers are massively exploiting a remote code execution vulnerability,\u00a0CVE-2021-25094, in the Tatsu Builder plugin for WordPress, which is installed on about 100,000 websites. [...]", "creation_timestamp": "2022-05-17T12:00:22.000000Z"}, {"uuid": "e67082e3-de01-4900-999d-2402657f303a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/itsec_news/668", "content": "\u200b\u26a1\ufe0f \u0414\u0435\u0441\u044f\u0442\u043a\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0430 WordPress \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\ud83d\udcac \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 Tatsu Builder, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 100 000 \u0441\u0430\u0439\u0442\u043e\u0432. Tatsu Builder \u2014 \u044d\u0442\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u043c\u043e\u0449\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432, \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0434\u043e 50 000 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432\u0441\u0451 \u0435\u0449\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u043b\u0430\u0433\u0438\u043d\u0430, \u0445\u043e\u0442\u044f \u043f\u0430\u0442\u0447 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0431\u044b\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0430\u043f\u0440\u0435\u043b\u044f. \u041f\u0435\u0440\u0432\u044b\u0435 \u043c\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c 10 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430 \u0438 \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u0438 \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0447\u0435\u0442\u044b\u0440\u0435 \u0434\u043d\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-25094 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 (\u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043e 3.3.12). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u041c\u0438\u0448\u0435\u043b\u0435\u043c \u0412\u0438\u043d\u0441\u0435\u043d\u0442\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0437\u0430\u044f\u0432\u0438\u043b \u043e \u043d\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043a\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 3.3.13 \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wordfence, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0430\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 WordPress, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u0438. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043e\u0442 20 000 \u0434\u043e 50 000 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Tatsu Builder. Wordfence \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e 14 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0430 5,9 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432. \u0421\u043f\u0443\u0441\u0442\u044f \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0441\u043d\u0438\u0437\u0438\u043b\u043e\u0441\u044c, \u043d\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0434\u0430\u0436\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\n#WordPress #TatsuBuilder #Wordfence\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-05-18T13:16:30.000000Z"}, {"uuid": "1d6509f8-1650-480f-bf2d-9bcb80544f20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/spammermarketool/39118", "content": "\ud83d\udd25 Best HQ Wordpress Exploit AiO Package \u2764\ufe0f\n\n\u2757\ufe0f NOTED : Not for Sale !!! \n\nMaybe you hard find exploit wordpress and this our channel want gift something special to everyone\nfor support our channel exploit must working with python I recommend python3 and python2 \ninstalled both in machine because tools some different coder and exploit will be needed different version 2.7 and 3\n\n\n\u26a0\ufe0f I am Not Responsible for Any Damage \u26a0\ufe0f\n\nCVE-2014-7969\nCVE-2014-9473\nCVE-2015-6522\nCVE-2016-10033\nCVE-2018-6389\nCVE-2019-20361-EXPLOIT\nCVE-2019-8942-RCE\nCVE-2020-11738\nCVE-2020-12800\nCVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE\nCVE-2021-24762\nCVE-2021-25094-tatsu-preauth-rce\nWordpress-Plugin-Spritz-RFI\nWORDPRESS-Revslider-Exploit-0DAY\nWordpress-scanner\nWordPress_4.9.8_RCE_POC\nWP-augmented-reality-RCE\nWP-Content-Injection-Exploit\nwp-file-manager-CVE-2020-25213\nwp-gravity-form-exploit\nwp-plugin-amministrazione-aperta-LFI\nWP-SMTP-0DAY\n\nDownload Here : https://t.me/hackingtoolsprvi8/2377", "creation_timestamp": "2022-06-20T19:53:12.000000Z"}, {"uuid": "aea116ca-f5c6-45e5-ad8d-4420fcd768bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/spammerspacer/33792", "content": "\ud83d\udd25 Best HQ Wordpress Exploit AiO Package \u2764\ufe0f\n\n\u2757\ufe0f NOTED : Not for Sale !!! \n\nMaybe you hard find exploit wordpress and this our channel want gift something special to everyone\nfor support our channel exploit must working with python I recommend python3 and python2 \ninstalled both in machine because tools some different coder and exploit will be needed different version 2.7 and 3\n\n\n\u26a0\ufe0f I am Not Responsible for Any Damage \u26a0\ufe0f\n\nCVE-2014-7969\nCVE-2014-9473\nCVE-2015-6522\nCVE-2016-10033\nCVE-2018-6389\nCVE-2019-20361-EXPLOIT\nCVE-2019-8942-RCE\nCVE-2020-11738\nCVE-2020-12800\nCVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE\nCVE-2021-24762\nCVE-2021-25094-tatsu-preauth-rce\nWordpress-Plugin-Spritz-RFI\nWORDPRESS-Revslider-Exploit-0DAY\nWordpress-scanner\nWordPress_4.9.8_RCE_POC\nWP-augmented-reality-RCE\nWP-Content-Injection-Exploit\nwp-file-manager-CVE-2020-25213\nwp-gravity-form-exploit\nwp-plugin-amministrazione-aperta-LFI\nWP-SMTP-0DAY\n\nDownload Here : https://t.me/hackingtoolsprvi8/2377", "creation_timestamp": "2022-06-20T19:53:12.000000Z"}, {"uuid": "55fd27b8-b2a7-499d-b334-4b389febd10c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/hackingtoolx/548", "content": "", "creation_timestamp": "2023-07-05T00:27:42.000000Z"}, {"uuid": "6f9ff408-75fb-4500-8ea7-92377b7c75b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "Telegram/U6rrihL1sb3sikqXd-AWO2PmtehZ9XBZNo2Q4stYoDsg", "content": "", "creation_timestamp": "2022-08-13T06:31:09.000000Z"}, {"uuid": "45e3d355-d3d2-4188-839c-30969b0a03f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/v3n0mhack/209", "content": "# Tatsudo: Tatsu <= 3.3.11 pre-auth RCE exploit\n# The exploit bypass Wordfence\n#\n# Product: Tatsu wordpress plugin <= 3.3.11\n# CVE: CVE-2021-25094 \n\nhttps://github.com/TatsumiOfficial/wp-scan/blob/main/wprce.py", "creation_timestamp": "2023-01-02T23:09:27.000000Z"}, {"uuid": "74651904-9aa7-422b-a923-235b5978679e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "Telegram/8AOW3sqlrNhnJrwkCUauFKK4HBCRHhlO1OhPSlGpXugqWrQ", "content": "", "creation_timestamp": "2022-11-07T06:30:35.000000Z"}, {"uuid": "93f9633a-9342-4e1b-93e6-3455a7d1c0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/freespamtools2020/43433", "content": "# Tatsudo: Tatsu <= 3.3.11 pre-auth RCE exploit\n# The exploit bypass Wordfence\n#\n# Product: Tatsu wordpress plugin <= 3.3.11\n# CVE: CVE-2021-25094 \n\nhttps://github.com/TatsumiOfficial/wp-scan/blob/main/wprce.py", "creation_timestamp": "2023-01-15T12:50:59.000000Z"}, {"uuid": "8e1b1dfa-b481-40d9-ae11-fed8e6041021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "Telegram/dt3wzguPwvHeMGbS-iOOUe43Y1n6HJwkKjrvq5BX_wYbkhfe", "content": "", "creation_timestamp": "2022-08-25T16:41:15.000000Z"}, {"uuid": "4ecd29f6-5365-416d-9639-7d27aef12c20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "Telegram/qA7RHbfeiqXzFaQFtQDWHegpUj17EgvuINx_Fz9sXMRGmneY", "content": "", "creation_timestamp": "2022-06-20T20:34:58.000000Z"}, {"uuid": "a4fb4e59-b092-44eb-b6f8-a0bd0c2eaddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/true_secator/2952", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RCE \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Tatsu Builder \u0434\u043b\u044f WordPress \u0441\u0442\u0430\u043b\u0430 \u043f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0430\u0442\u0430\u043a. \n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Wordfence, \u0441 10 \u043f\u043e 14 \u043c\u0430\u044f \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043e 5,9 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-25094 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u043e\u0447\u0442\u0438 \u043d\u0430 100 000 \u0441\u0430\u0439\u0442\u0430\u0445.\n\nTatsu Builder - \u044d\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0438\u0439 \u043c\u043e\u0449\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0\u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 (\u0432\u0441\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043e 3.3.12). \n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0412\u0438\u043d\u0441\u0435\u043d\u0442\u043e\u043c \u041c\u0438\u0448\u0435\u043b\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439\u00a0\u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0435\u0435\u00a028 \u043c\u0430\u0440\u0442\u0430 2022 \u0433\u043e\u0434\u0430 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c (PoC).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 3.3.13 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0430\u043f\u0440\u0435\u043b\u044f, \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f, \u0432\u0435\u0434\u044c 50 000 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Tatsu Builder.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0434\u0440\u043e\u043f\u043f\u0435\u0440 \u00absp3ctra_XO.php\u00bb (\u0438\u043c\u0435\u0435\u0442 \u0445\u044d\u0448 MD5 3708363c5b7bf582f8477b1c82c8cbf8) \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u00abwp-content/uploads/typehub/custom/\u00bb \u0438 \u0441\u043a\u0440\u044b\u0442\u044c \u0435\u0433\u043e.\u00a0\u041f\u0440\u0438 \u044d\u0442\u043e\u043c Wordfence \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0441 \u0442\u0440\u0435\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432: 148.251.183[.]254, 176.9.117[.]218 \u0438 217.160.145[.]62.\u00a0\n\n\u0412\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0430 Tatsu Builder \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.3.13.\n\n\u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u043c\u0438, \u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0432 \u0441\u0432\u043e\u0439 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0432\u0441\u0435 \u0436\u0435 \u0441\u0442\u043e\u0438\u0442.", "creation_timestamp": "2022-05-18T11:40:39.000000Z"}, {"uuid": "1636f6c4-d9a0-4401-bf55-de4e37c25598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/LeakingXTeam/20993", "content": "\ud83d\udd25 Best HQ Wordpress Exploit AiO Package \u2764\ufe0f\n\n\u2757\ufe0f NOTED : Not for Sale !!! \n\nMaybe you hard find exploit wordpress and this our channel want gift something special to everyone\nfor support our channel exploit must working with python I recommend python3 and python2 \ninstalled both in machine because tools some different coder and exploit will be needed different version 2.7 and 3\n\n\n\u26a0\ufe0f I am Not Responsible for Any Damage \u26a0\ufe0f\n\nCVE-2014-7969\nCVE-2014-9473\nCVE-2015-6522\nCVE-2016-10033\nCVE-2018-6389\nCVE-2019-20361-EXPLOIT\nCVE-2019-8942-RCE\nCVE-2020-11738\nCVE-2020-12800\nCVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE\nCVE-2021-24762\nCVE-2021-25094-tatsu-preauth-rce\nWordpress-Plugin-Spritz-RFI\nWORDPRESS-Revslider-Exploit-0DAY\nWordpress-scanner\nWordPress_4.9.8_RCE_POC\nWP-augmented-reality-RCE\nWP-Content-Injection-Exploit\nwp-file-manager-CVE-2020-25213\nwp-gravity-form-exploit\nwp-plugin-amministrazione-aperta-LFI\nWP-SMTP-0DAY\n\nDownload Here : https://t.me/hackingtoolsprvi8/2377", "creation_timestamp": "2022-06-20T19:53:12.000000Z"}, {"uuid": "588d6e73-4782-4b77-90a0-a4a7b4e987c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/xakep_ru/12368", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 Tatsu Builder \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442\u0441\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-25094) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Tatsu Builder \u0434\u043b\u044f WordPress, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 100 000 \u0441\u0430\u0439\u0442\u043e\u0432. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u043a\u043e\u043b\u043e 50 000 \u0441\u0430\u0439\u0442\u043e\u0432, \u0445\u043e\u0442\u044f \u043f\u0430\u0442\u0447 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0430\u043f\u0440\u0435\u043b\u044f.\n\nhttps://xakep.ru/2022/05/18/tatsu-builder/", "creation_timestamp": "2022-05-18T17:34:04.000000Z"}, {"uuid": "3b3cb34a-8ee2-4447-a9cc-d0cd82b3a584", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "https://t.me/hackingtoolsprvi8/2727", "content": "\ud83d\udd25 Best HQ Wordpress Exploit AiO Package \u2764\ufe0f\n\n\u2757\ufe0f NOTED : Not for Sale !!! \n\nMaybe you hard find exploit wordpress and this our channel want gift something special to everyone\nfor support our channel exploit must working with python I recommend python3 and python2 \ninstalled both in machine because tools some different coder and exploit will be needed different version 2.7 and 3\n\n\n\u26a0\ufe0f I am Not Responsible for Any Damage \u26a0\ufe0f\n\nCVE-2014-7969\nCVE-2014-9473\nCVE-2015-6522\nCVE-2016-10033\nCVE-2018-6389\nCVE-2019-20361-EXPLOIT\nCVE-2019-8942-RCE\nCVE-2020-11738\nCVE-2020-12800\nCVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE\nCVE-2021-24762\nCVE-2021-25094-tatsu-preauth-rce\nWordpress-Plugin-Spritz-RFI\nWORDPRESS-Revslider-Exploit-0DAY\nWordpress-scanner\nWordPress_4.9.8_RCE_POC\nWP-augmented-reality-RCE\nWP-Content-Injection-Exploit\nwp-file-manager-CVE-2020-25213\nwp-gravity-form-exploit\nwp-plugin-amministrazione-aperta-LFI\nWP-SMTP-0DAY\n\nDownload Here : https://t.me/hackingtoolsprvi8/2377", "creation_timestamp": "2022-08-25T16:41:15.000000Z"}, {"uuid": "a7d39581-a309-4479-91ff-18db2334eae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "Telegram/TQnlrOrG-XF3yDb1L8SMYm6bGPoSuE33R6LssiDpFx4KMA", "content": "", "creation_timestamp": "2026-08-18T13:00:08.114498Z"}, {"uuid": "81caae5e-0e0e-431d-bd57-b85cbda17571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "published-proof-of-concept", "source": "Telegram/TQnlrOrG-XF3yDb1L8SMYm6bGPoSuE33R6LssiDpFx4KMA", "content": "", "creation_timestamp": "2026-08-19T00:00:10.941999Z"}, {"uuid": "b0bcc085-eb84-495f-9371-6a7afb97d67e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://t.me/hacking_Attack/53795", "content": "Exploit Collector\nWordPress Tatsu Builder Remote Code Execution\n\nhttps://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png \nWordPress Tatsu Builder plugin versions prior to 3.3.13 suffer from an unauthenticated remote code execution vulnerability.\n\nSHA-256 | 632f285a1a3ec46f04fb233958d273d11b2e22568b10b2920f52c77d06e276ea\n\nDownload\nDescription: Unauthenticated Remote Code Execution\n\nAffected Plugin: Tatsu Builder\n\nPlugin Slug: tatsu\n\nPlugin Developer: BrandExponents\n\nAffected Versions: < 3.3.13\n\nCVE ID: CVE-2021-25094\n\nCVSS Score: 8.1 (High)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nResearcher/s: Vincent Michel (darkpills)\n\nFully Patched Version: 3.3.13\n\nIndicators of Attack\n\nMost of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin.\n\nThese may appear in your logs with the following URL:\n\n/wp-admin/admin-ajax.php?action=add_custom_font\n\nThe vast majority of attacks are the work of just a few IP addresses.\n\nThe top 3 attacking IP addresses have each attacked over 1 million sites:\n\n148.251.183.254\n\n176.9.117.218\n\n217.160.145.62\n\nAn additional 15 IP addresses have each attacked over 100,000 sites:\n\n65.108.104.19\n\n62.197.136.102\n\n51.38.41.15\n\n31.210.20.170\n\n31.210.20.101\n\n85.202.169.175\n\n85.202.169.71\n\n85.202.169.86\n\n85.202.169.36\n\n85.202.169.83\n\n85.202.169.92\n\n194.233.87.7\n\n2.56.56.203\n\n85.202.169.129\n\n135.181.0.188\n\nIndicators of Compromise\n\nThe most common payload we\u2019ve seen is a dropper used to place additional malware located in a randomly-named subfolder of wp-content/uploads/typehub/custom/ such as wp-content/uploads/typehub/custom/vjxfvzcd.\n\nThe dropper is typically named .sp3ctra_XO.php and has an MD5 hash of 3708363c5b7bf582f8477b1c82c8cbf8.\n\nNote the dot at the beginning as this indicates a hidden file, which is necessary to exploit the vulnerability as it takes advantage of a race condition.\n\nThis file is detected by the Wordfence scanner.\n\nWhat Should I do?\n\nAll Wordfence users with the Wordfence Web Application Firewall active, including Wordfence free customers, are protected against this vulnerability. Nonetheless, if you use the Tatsu Builder plugin, we strongly recommend updating to the latest version available, which is 3.3.13 at the time of this writing. Please note that version 3.3.12 contained a partial patch but did not fully address all issues.\n\nIf you know anyone using the Tatsu Builder plugin on their site, we urge you to forward this article to them as this is a large-scale attack and any vulnerable sites that are not updated and not using some form of a Web Application Firewall are at risk of complete site takeover.\n\nIf you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:39.342051Z"}, {"uuid": "16dec057-a343-4344-8671-e712ba38841a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://t.me/hacking_Attack/53795", "content": "Exploit Collector\nWordPress Tatsu Builder Remote Code Execution\n\nhttps://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png \nWordPress Tatsu Builder plugin versions prior to 3.3.13 suffer from an unauthenticated remote code execution vulnerability.\n\nSHA-256 | 632f285a1a3ec46f04fb233958d273d11b2e22568b10b2920f52c77d06e276ea\n\nDownload\nDescription: Unauthenticated Remote Code Execution\n\nAffected Plugin: Tatsu Builder\n\nPlugin Slug: tatsu\n\nPlugin Developer: BrandExponents\n\nAffected Versions: < 3.3.13\n\nCVE ID: CVE-2021-25094\n\nCVSS Score: 8.1 (High)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nResearcher/s: Vincent Michel (darkpills)\n\nFully Patched Version: 3.3.13\n\nIndicators of Attack\n\nMost of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin.\n\nThese may appear in your logs with the following URL:\n\n/wp-admin/admin-ajax.php?action=add_custom_font\n\nThe vast majority of attacks are the work of just a few IP addresses.\n\nThe top 3 attacking IP addresses have each attacked over 1 million sites:\n\n148.251.183.254\n\n176.9.117.218\n\n217.160.145.62\n\nAn additional 15 IP addresses have each attacked over 100,000 sites:\n\n65.108.104.19\n\n62.197.136.102\n\n51.38.41.15\n\n31.210.20.170\n\n31.210.20.101\n\n85.202.169.175\n\n85.202.169.71\n\n85.202.169.86\n\n85.202.169.36\n\n85.202.169.83\n\n85.202.169.92\n\n194.233.87.7\n\n2.56.56.203\n\n85.202.169.129\n\n135.181.0.188\n\nIndicators of Compromise\n\nThe most common payload we\u2019ve seen is a dropper used to place additional malware located in a randomly-named subfolder of wp-content/uploads/typehub/custom/ such as wp-content/uploads/typehub/custom/vjxfvzcd.\n\nThe dropper is typically named .sp3ctra_XO.php and has an MD5 hash of 3708363c5b7bf582f8477b1c82c8cbf8.\n\nNote the dot at the beginning as this indicates a hidden file, which is necessary to exploit the vulnerability as it takes advantage of a race condition.\n\nThis file is detected by the Wordfence scanner.\n\nWhat Should I do?\n\nAll Wordfence users with the Wordfence Web Application Firewall active, including Wordfence free customers, are protected against this vulnerability. Nonetheless, if you use the Tatsu Builder plugin, we strongly recommend updating to the latest version available, which is 3.3.13 at the time of this writing. Please note that version 3.3.12 contained a partial patch but did not fully address all issues.\n\nIf you know anyone using the Tatsu Builder plugin on their site, we urge you to forward this article to them as this is a large-scale attack and any vulnerable sites that are not updated and not using some form of a Web Application Firewall are at risk of complete site takeover.\n\nIf you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:49.102372Z"}, {"uuid": "02e560f4-56f9-4fc6-bc35-39be7d5b3845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/hacking_Attack/53795", "content": "Exploit Collector\nWordPress Tatsu Builder Remote Code Execution\n\nhttps://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png \nWordPress Tatsu Builder plugin versions prior to 3.3.13 suffer from an unauthenticated remote code execution vulnerability.\n\nSHA-256 | 632f285a1a3ec46f04fb233958d273d11b2e22568b10b2920f52c77d06e276ea\n\nDownload\nDescription: Unauthenticated Remote Code Execution\n\nAffected Plugin: Tatsu Builder\n\nPlugin Slug: tatsu\n\nPlugin Developer: BrandExponents\n\nAffected Versions: < 3.3.13\n\nCVE ID: CVE-2021-25094\n\nCVSS Score: 8.1 (High)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nResearcher/s: Vincent Michel (darkpills)\n\nFully Patched Version: 3.3.13\n\nIndicators of Attack\n\nMost of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin.\n\nThese may appear in your logs with the following URL:\n\n/wp-admin/admin-ajax.php?action=add_custom_font\n\nThe vast majority of attacks are the work of just a few IP addresses.\n\nThe top 3 attacking IP addresses have each attacked over 1 million sites:\n\n148.251.183.254\n\n176.9.117.218\n\n217.160.145.62\n\nAn additional 15 IP addresses have each attacked over 100,000 sites:\n\n65.108.104.19\n\n62.197.136.102\n\n51.38.41.15\n\n31.210.20.170\n\n31.210.20.101\n\n85.202.169.175\n\n85.202.169.71\n\n85.202.169.86\n\n85.202.169.36\n\n85.202.169.83\n\n85.202.169.92\n\n194.233.87.7\n\n2.56.56.203\n\n85.202.169.129\n\n135.181.0.188\n\nIndicators of Compromise\n\nThe most common payload we\u2019ve seen is a dropper used to place additional malware located in a randomly-named subfolder of wp-content/uploads/typehub/custom/ such as wp-content/uploads/typehub/custom/vjxfvzcd.\n\nThe dropper is typically named .sp3ctra_XO.php and has an MD5 hash of 3708363c5b7bf582f8477b1c82c8cbf8.\n\nNote the dot at the beginning as this indicates a hidden file, which is necessary to exploit the vulnerability as it takes advantage of a race condition.\n\nThis file is detected by the Wordfence scanner.\n\nWhat Should I do?\n\nAll Wordfence users with the Wordfence Web Application Firewall active, including Wordfence free customers, are protected against this vulnerability. Nonetheless, if you use the Tatsu Builder plugin, we strongly recommend updating to the latest version available, which is 3.3.13 at the time of this writing. Please note that version 3.3.12 contained a partial patch but did not fully address all issues.\n\nIf you know anyone using the Tatsu Builder plugin on their site, we urge you to forward this article to them as this is a large-scale attack and any vulnerable sites that are not updated and not using some form of a Web Application Firewall are at risk of complete site takeover.\n\nIf you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T20:00:05.624538Z"}, {"uuid": "ed20d1ed-4ad8-4d10-9b12-54315f4a342c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "exploited", "source": "https://t.me/hacking_Attack/53795", "content": "Exploit Collector\nWordPress Tatsu Builder Remote Code Execution\n\nhttps://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png \nWordPress Tatsu Builder plugin versions prior to 3.3.13 suffer from an unauthenticated remote code execution vulnerability.\n\nSHA-256 | 632f285a1a3ec46f04fb233958d273d11b2e22568b10b2920f52c77d06e276ea\n\nDownload\nDescription: Unauthenticated Remote Code Execution\n\nAffected Plugin: Tatsu Builder\n\nPlugin Slug: tatsu\n\nPlugin Developer: BrandExponents\n\nAffected Versions: < 3.3.13\n\nCVE ID: CVE-2021-25094\n\nCVSS Score: 8.1 (High)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nResearcher/s: Vincent Michel (darkpills)\n\nFully Patched Version: 3.3.13\n\nIndicators of Attack\n\nMost of the attacks we have seen are probing attacks to determine the presence of a vulnerable plugin.\n\nThese may appear in your logs with the following URL:\n\n/wp-admin/admin-ajax.php?action=add_custom_font\n\nThe vast majority of attacks are the work of just a few IP addresses.\n\nThe top 3 attacking IP addresses have each attacked over 1 million sites:\n\n148.251.183.254\n\n176.9.117.218\n\n217.160.145.62\n\nAn additional 15 IP addresses have each attacked over 100,000 sites:\n\n65.108.104.19\n\n62.197.136.102\n\n51.38.41.15\n\n31.210.20.170\n\n31.210.20.101\n\n85.202.169.175\n\n85.202.169.71\n\n85.202.169.86\n\n85.202.169.36\n\n85.202.169.83\n\n85.202.169.92\n\n194.233.87.7\n\n2.56.56.203\n\n85.202.169.129\n\n135.181.0.188\n\nIndicators of Compromise\n\nThe most common payload we\u2019ve seen is a dropper used to place additional malware located in a randomly-named subfolder of wp-content/uploads/typehub/custom/ such as wp-content/uploads/typehub/custom/vjxfvzcd.\n\nThe dropper is typically named .sp3ctra_XO.php and has an MD5 hash of 3708363c5b7bf582f8477b1c82c8cbf8.\n\nNote the dot at the beginning as this indicates a hidden file, which is necessary to exploit the vulnerability as it takes advantage of a race condition.\n\nThis file is detected by the Wordfence scanner.\n\nWhat Should I do?\n\nAll Wordfence users with the Wordfence Web Application Firewall active, including Wordfence free customers, are protected against this vulnerability. Nonetheless, if you use the Tatsu Builder plugin, we strongly recommend updating to the latest version available, which is 3.3.13 at the time of this writing. Please note that version 3.3.12 contained a partial patch but did not fully address all issues.\n\nIf you know anyone using the Tatsu Builder plugin on their site, we urge you to forward this article to them as this is a large-scale attack and any vulnerable sites that are not updated and not using some form of a Web Application Firewall are at risk of complete site takeover.\n\nIf you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:37.170507Z"}, {"uuid": "fa010a27-1f45-4140-8efd-14f09cf8d26c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25094", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_tatsu_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Vincent Michel\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module adds exploit for CVE-2021-25094 - unauthenticated remote code execution in Tatsu Wordpress plugin <= 3.3.11. Module uploads malicious zip with PHP payload that gets executed in second part of exploit.\", \"disclosure_date\": \"2022-04-25\", \"fullname\": \"exploit/multi/http/wp_tatsu_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Tatsu Wordpress Plugin RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_tatsu_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/wp_tatsu_rce\", \"references\": [\"CVE-2021-25094\", \"EDB-52260\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:23.293542Z"}]}