Tatsu < 3.3.12 - Unauthenticated RCE

An unauthenticated attacker sends a POST request to `/wp-admin/admin-ajax.php` with `action=add_custom_font` and a crafted zip file [ref_id=1]. The zip contains a PHP shell whose filename starts with a dot (e.g. `.shell.php`), which bypasses the plugin's extension check because WordPress's `list_files()` function skips hidden files [ref_id=1]. The zip is extracted under `/wp-content/uploads/typehub/custom/tatsu/`, making the shell accessible via HTTP [ref_id=1]. A race condition during extraction (CWE-362) also allows the shell to be called before cleanup, but the hidden-file bypass eliminates the need for a race entirely [ref_id=1].

The vulnerable code is in the `add_custom_font` AJAX action handler, which calls `unzip_file()` to extract uploaded zip archives into the `typehub_font_dir` directory [ref_id=1]. The extension validation relies on WordPress's `list_files()` function, which skips files whose names start with a dot (`.`), allowing hidden PHP shells to pass through [ref_id=1].

The advisory states the vulnerability is fixed in Tatsu version 3.3.12 [ref_id=2]. No patch diff is provided in the bundle, but the researcher notes that the root issues are: (1) the `add_custom_font` action lacks authentication checks, (2) the extension validation uses `list_files()` which skips dot-prefixed files, and (3) the zip extraction and cleanup have a race window [ref_id=1]. A proper fix would require authenticating the AJAX action, validating all extracted files (including hidden ones), and ensuring files are not accessible during extraction.