Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in WordPress TheCartPress allows unauthenticated attackers to create administrator accounts. This is significant because it means an attacker could gain complete control of your WordPress site without needing any prior access.
- It impacts WordPress sites using the plugin.
- Attackers can take over your website.
- No login is needed to exploit this.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the vulnerable WordPress plugin's AJAX handler. This request would manipulate the `tcp_role` parameter to grant administrator privileges, effectively allowing the attacker to take full control of the website without needing any prior access.
- Targets public-facing WordPress sites.
- Exploits AJAX handler without authentication.
- Requires setting `tcp_role` to administrator.
Live Threat
Current exploitation, exposure, and threat context
This unauthenticated privilege escalation in TheCartPress allows any unauthenticated attacker to create an administrator account. WordPress sites are common targets, and this vulnerability offers a direct path to full control without needing prior access or user interaction.
- Public exploit available.
- No KEV listing observed.
- Recency signal: Published in 2021.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize containing TheCartPress instances that allow unauthenticated users to create administrator accounts. Actively monitor for any signs of new administrator accounts being created on your WordPress sites, as this vulnerability could allow attackers to gain full control. If exploitation is detected, immediately isolate affected services.
- Block access to the registration handler.
- Monitor for new admin accounts.
- Disable TheCartPress plugin.
