PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47932 TheCartPress CVE debrief

CVE-2021-47932 is a critical unauthenticated privilege-escalation issue affecting TheCartPress 1.5.3.6. Crafted POST requests to the tcp_register_and_login_ajax action can set tcp_role=administrator, allowing an attacker to create administrator accounts and gain full administrative access without credentials.

Vendor
TheCartPress
Product
TheCartPress
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-07-25
Advisory published
2026-05-10
Advisory updated
2026-07-25

Who should care

WordPress site owners, administrators, and managed service providers running TheCartPress 1.5.3.6, especially on internet-facing sites and any environment that delegates plugin maintenance.

Technical summary

The supplied record describes an authorization failure in TheCartPress's AJAX registration/login handler. Because the endpoint accepts unauthenticated POST requests and honors a user-controlled role parameter, an attacker can submit a request that creates an administrator-level account. The supplied metadata classifies the weakness as CWE-862 and rates the issue Critical (CVSS 9.3).

Defensive priority

Immediate. This is a network-reachable, unauthenticated path to administrator access and should be treated as a site-compromise risk until the plugin is removed, disabled, or otherwise confirmed fixed.

Recommended defensive actions

  • Inventory WordPress installations for TheCartPress 1.5.3.6.
  • Disable or remove the plugin until a verified fix is available.
  • Review administrator accounts and recent account-creation activity for unauthorized changes.
  • Check web and application logs for POST requests to tcp_register_and_login_ajax and other suspicious registration activity.
  • If compromise is suspected, rotate credentials and investigate for follow-on changes to users, plugins, themes, and content.

Evidence notes

The supplied source set includes the official CVE record, the NVD detail page, a WordPress plugin page for TheCartPress, a VulnCheck advisory, and an Exploit-DB listing. The metadata marks the vulnerability status as 'Received' and identifies CWE-862 as the primary weakness. No CISA KEV data was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-47932 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-47932

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-47932 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-47932

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.