CVE-2021-47932: TheCartPress for WordPress Unauthenticated Privilege Escalation
CVE-2021-47932 is a critical missing-authorization flaw in TheCartPress for WordPress, affecting versions up to and including 1.5.3.6. According to the record, an unauthenticated attacker can create administrator accounts through the plugin's AJAX handler. No fixed version is listed in the sources consulted, and the vulnerability is not in CISA KEV.
Overview
CVE-2021-47932 affects TheCartPress, a WordPress plugin that the record lists under the product name Thecartpress TheCartPress. The record describes a missing authorization check (CWE-862) in the plugin's AJAX handling, which allows an unauthenticated user to create administrator accounts. The CVE was published on 2026-05-10 and its CNA is VulnCheck.
Impact
The record rates the issue as critical, with a CVSS 3.1 base score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. VulnCheck also lists a CVSS 4.0 score of 9.3. If exploited, the flaw would give an attacker full administrative control of the affected WordPress site, including access to content, users, and configuration.
Affected products and versions
- Product: Thecartpress TheCartPress (WordPress plugin)
- Affected versions: up to and including 1.5.3.6, according to the record
- Fixed versions: none listed in the record. This does not prove that no fix exists; the status of a fix is unknown from the sources consulted.
Exploitation status
The record shows that CISA KEV does not list this CVE, so no active exploitation is confirmed in the sources consulted. The SSVC field records exploitation as proof-of-concept and marks the issue as automatable. The record also contains a reference tagged as exploit material. The EPSS probability is 0.00403 (dated 2026-10-13). These data points indicate that public exploit material may exist, but they do not confirm attacks in the wild.
Remediation and mitigation
- Identify every WordPress site that runs TheCartPress and confirm the installed version.
- Because no fixed version is listed in the record, check the plugin's official page and vendor channels for updates, and treat any version up to 1.5.3.6 as vulnerable until a fix is confirmed.
- If no fix is available, consider removing or disabling the plugin until a supported alternative or patched release is in place.
- Restrict new account creation, review existing administrator accounts for unexpected entries, and reset credentials where suspicious accounts are found.
Detection guidance
- Review user lists for administrator accounts created without a documented business reason, especially around the publication date of the advisory.
- Audit web server and application logs for unusual requests to the plugin's AJAX endpoints from unauthenticated sources.
- Monitor for new administrator role assignments and for logins from unfamiliar addresses following such activity.
Limitations of the available information
The record does not state the exact fixed version, the plugin's current release status, or whether the vendor has issued an advisory. Its exploitation data (SSVC proof-of-concept and EPSS) reflects estimates rather than confirmed attacks. The affected version range is taken from the record and should be verified against the plugin's own release history.
Frequently asked questions
What does CVE-2021-47932 allow an attacker to do?
According to the record, an unauthenticated attacker can create administrator accounts in TheCartPress up to version 1.5.3.6, which can lead to full administrative control of the WordPress site.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does indicate proof-of-concept availability and a reference tagged as exploit material.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.