What’s Vulnerable › Vulnerabilities

CVE-2021-47932: WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-10 · updated 2026-07-25
• Weakness: CWE-862

Description

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

Affected products

• TheCartPress: through 1.5.3.6

References

• https://wordpress.org/plugin/thecartpress
• https://www.exploit-db.com/exploits/50378
• https://www.vulncheck.com/advisories/wordpress-thecartpress-privilege-escalation-unauthenticated

Get alerted when CVE-2021-47932 or the next vulnerability affects your stack