CVE-2021-47932 | WordPress TheCartPress 1.5.3.6 contains an unauthenticated p… | CVSS 9.8 CRITICAL

Description

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

Metadata

CVE ID: CVE-2021-47932
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-01 11:24 UTC
Published: 2026-05-10 12:43 UTC
Last updated: 2026-07-15 01:24 UTC
Primary CWE: CWE-862
Missing Authorization
Vendor / Product: thecartpress / TheCartPress
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
thecartpress	TheCartPress	—	0 ≤ 1.5.3.6

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	Missing Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-50378 https://www.exploit-db.com/exploits/50378
Official Product Homepage https://wordpress.org/plugin/thecartpress
VulnCheck Advisory: WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated https://www.vulncheck.com/advisories/wordpress-thecartpress-privilege-escalation-unauthenticated