Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47932WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

Critical 9.8

In plain English

A critical-severity missing authorization in TheCartPress from thecartpress. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

Affected products (as reported)

Vendor	Product	Versions
thecartpress	TheCartPress	0 – through 1.5.3.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-50378 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated third-party-advisory