Introduction
An abandoned WordPress e-commerce plugin, with no patch available, still lets anyone take over hundreds of sites with a single unauthenticated HTTP request. CVE-2021-47932 targets TheCartPress, a WordPress shopping cart plugin last updated in January 2017 and removed for good from the WordPress plugin repository in October 2021 because of this exact bug.
TheCartPress was a free, open source e-commerce plugin for WordPress that added a shopping cart, a product catalog, and checkout. Over its lifetime it passed 200,000 downloads according to Wordfence. Even after the removal, roughly 500 installations are still active, so the attack surface is small but real.
Technical Information
The root cause of CVE-2021-47932 is a missing authorization check (CWE-862) in the plugin's AJAX registration handler. The vulnerable function, tcp_register_and_login_ajax, is registered through a WordPress "nopriv" hook. The wp_ajax_nopriv_ prefix makes an AJAX action reachable by users who are not logged in. That is fine for actions like login or public search, but dangerous when the handler does privileged work without checking who the caller is or what they are allowed to do.
The function reads the tcp_role parameter straight from the incoming POST request and assigns that role to the new WordPress user. Nothing checks whether the requester is allowed to create users, and nothing restricts which roles can be assigned. So an attacker sets tcp_role to administrator and gets a fully privileged account.
Attack Flow
The exploitation path is short:
- The attacker finds a WordPress site running TheCartPress (version 1.5.3.6 or earlier).
- The attacker sends a POST request to
wp-admin/admin-ajax.phpon the target site. - The POST body includes these parameters:
| Parameter | Value | Purpose |
|---|---|---|
| action | tcp_register_and_login_ajax | Targets the vulnerable AJAX handler |
| tcp_role | administrator | Grants full administrative privileges |
| tcp_new_user_name | Arbitrary string | Sets the new administrator username |
| tcp_new_user_pass | Arbitrary string | Sets the new administrator password |
| tcp_new_user_email | Arbitrary email | Sets the new administrator email address |
- The server processes the request, creates a user with the
administratorrole, and returns an empty string on success. - The attacker logs in with the new credentials and has full control over the WordPress installation.
A public proof of concept written in Python has been on Exploit-DB since October 2021. The script runs the whole flow and confirms success by checking for an empty string response from the server. If a Web Application Firewall is set up to block the request, the server returns a 403 Forbidden instead.
Patchstack and WPScan rate this vulnerability 9.8 (Critical). VulnCheck assigns a CVSS v4 score of 9.3. The critical rating comes from the fact that exploitation needs no authentication and no user interaction, and it ends in complete compromise of the WordPress installation.
Affected Systems and Versions
Every version of the WordPress TheCartPress plugin up to and including 1.5.3.6 is affected. That is the final released version. No patched version exists.
The plugin was closed for good on the WordPress plugin repository on October 5, 2021. Even so, Wordfence reports roughly 500 active installations. Any WordPress site still running TheCartPress, in any version, is vulnerable.
Vendor Security History
TheCartPress has a documented history of critical vulnerabilities spanning nearly a decade:
| Vulnerability Type | Published Date | Fixed Version | CVSS Score |
|---|---|---|---|
| Unauthenticated Admin Creation | 2021-10-05 | No known fix | 9.8 |
| Multiple Vulnerabilities | 2015-04-29 | 1.3.9.3 | 7.5 |
| Remote File Inclusion | 2014-08-01 | 1.1.2 | Not Available |
| Cross Site Scripting | 2011-12-31 | 1.1.6 | Not Available |
This run of critical issues, plus the plugin's abandonment in 2017, led to the unpatched 2021 privilege escalation flaw that forced the plugin's removal from the WordPress repository.
References
- NVD Entry for CVE-2021-47932
- WordPress Plugin Repository: TheCartPress (Closed)
- Exploit-DB: WordPress Plugin TheCartPress 1.5.3.6 Privilege Escalation
- VulnCheck Advisory: WordPress TheCartPress Privilege Escalation Unauthenticated
- Patchstack: Privilege Escalation in WordPress TheCartPress Plugin
- Patchstack: Patching an Arbitrary User Creation Security Bug in TheCartPress Plugin
- WPScan: TheCartPress eCommerce Shopping Cart
- WPScan: TheCartPress Vulnerability Detail
- Wordfence: TheCartPress eCommerce Shopping Cart
