Your online store could be handing out master keys to complete strangers — and it wouldn't even ask for a password.
Who's at Risk — and How Bad Is It?
If your WordPress website uses a plugin called TheCartPress to run your e-commerce store, you may be sitting on one of the most dangerous classes of security flaws that exists: a vulnerability that lets anyone on the internet instantly promote themselves to full site administrator, no login credentials required. That's not a typo. No account. No password. No invitation. Just a carefully crafted message sent to your website, and a stranger now owns it.
TheCartPress is a WordPress shopping cart plugin designed to help small and medium-sized businesses sell products online. WordPress itself powers roughly 43% of all websites on the internet — hundreds of millions of sites — and plugins like TheCartPress are the building blocks that store owners rely on to keep their businesses running. When one of those building blocks cracks, the blast radius can be enormous. We're talking about stolen customer data, hijacked payment flows, ransomware planted quietly in the background, and businesses that wake up one morning to find they no longer control their own website.
What an Attacker Actually Does
Picture your website as a large office building. Normally, to get into the executive suite, you need to be buzzed in at the front desk — you show ID, you're on the list, you get a badge. TheCartPress version 1.5.3.6 has a side door that anyone can walk through. Behind that door is a button labeled "Make me the boss." Press it, and the building's security system happily hands over a master keycard.
In practice, here's what happens: an attacker visits your website and, instead of browsing your products, they send a hidden background request — the kind web browsers make all the time when they're quietly fetching data or submitting forms. That request tells your site: "Hey, I'm registering a new account, and by the way, I'm an administrator." The vulnerable version of TheCartPress doesn't check whether the person making that request has any right to claim that role. It just... complies. Within seconds, the attacker has a fully privileged administrator account and can do anything a site owner can do: install software, read every customer's order history and personal details, change your payment settings, delete your entire store, or quietly plant malicious code that infects every visitor.
What makes this especially dangerous is the zero-barrier entry. Most website attacks require at least some foothold — a phishing email that works, a password that gets guessed, a previous account to exploit. This one requires nothing. Any script kiddie with a tutorial and a free afternoon could automate this attack across thousands of sites simultaneously.
The Technical Detail That Makes This So Severe
For security researchers and defenders, here's the specific mechanism: the vulnerability lives in the plugin's AJAX handler for the tcp_register_and_login_ajax action. This endpoint, reachable via an unauthenticated HTTP POST request to WordPress's standard wp-admin/admin-ajax.php interface, accepts a tcp_role parameter. In version 1.5.3.6, there is no capability check or nonce validation on this handler — meaning the server performs zero authorization verification before honoring the role assignment. Setting tcp_role=administrator in the POST body is sufficient to trigger full privilege escalation. This is a textbook Broken Access Control / Unauthenticated Privilege Escalation vulnerability, and it carries a CVSS score of 9.8 out of 10 — Critical. That near-perfect score reflects the fact that it requires no user interaction, no prior access, and no special conditions to exploit.
Has Anyone Been Attacked Yet?
As of the time of writing, no confirmed active exploitation has been documented in the wild — meaning security researchers haven't yet caught real attackers using this specific flaw in live campaigns. That's the only piece of good news here. But the security community's guidance is consistent and urgent: the window between "no known exploitation" and "actively abused at scale" can close very fast once a vulnerability like this becomes public knowledge. Automated scanning tools used by criminal groups can identify and exploit vulnerable sites within hours of a disclosure. The clock is ticking.
The vulnerability was assigned CVE-2021-47932, indicating it was originally identified and catalogued years ago — which raises its own uncomfortable question about how many sites have been quietly running vulnerable code without ever being notified.
What You Should Do Right Now
If you run a WordPress site, here are three concrete steps to take today:
- Check your plugin version immediately. Log into your WordPress dashboard, navigate to Plugins → Installed Plugins, and look for TheCartPress. If you are running version 1.5.3.6 or earlier, you are vulnerable. Check whether a patched update is available and install it now. If no update exists in the WordPress plugin repository, treat the plugin as abandoned and move to step two.
- Deactivate and remove the plugin if no patch is available. An unpatched plugin doing nothing is still a loaded gun. Go to Plugins → Installed Plugins, deactivate TheCartPress, then delete it entirely. Yes, this may temporarily break your store's functionality — but a broken store is recoverable. A fully compromised store is a crisis. Consider migrating to an actively maintained alternative such as WooCommerce or Easy Digital Downloads.
- Audit your administrator accounts right now. Go to Users → All Users in your WordPress dashboard and filter by the Administrator role. If you see any accounts you don't recognize, delete them immediately and change all existing administrator passwords. Also review your site's files and recently installed plugins for anything unfamiliar — a thorough scan using a security plugin like Wordfence or Sucuri Security can help surface hidden backdoors that may have been planted if an attacker got in before you patched.
The broader lesson here is one the security community keeps having to relearn: plugins are attack surface. Every plugin you install on a WordPress site is code running with the full trust of your web server. Auditing what you've installed, keeping everything updated, and removing anything abandoned or unnecessary isn't optional housekeeping — it's the foundation of keeping your customers, your data, and your business safe.
CVE-2021-47932 | CVSS 9.8 Critical | Affected: TheCartPress ≤ 1.5.6.3 | Category: Unauthenticated Privilege Escalation