TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation flaw that allows any web visitor to create new administrator accounts by submitting crafted POST requests to the tcp_register_and_login_ajax AJAX handler. The attack bypasses authentication checks and grants full administrative privileges, enabling complete control over the WordPress site. This failure of authorization (CWE-862) exposes the entire installation to compromise.

The vulnerability affects the TheCartPress plugin version 1.5.3.6 used on WordPress sites. Only installations running that specific version are vulnerable until they receive a patch or update.

The flaw carries a CVSS score of 9.3, reflecting a critical severity. Its EPSS score is not provided, and it is not listed in the CISA KEV catalog. The attack does not require prior authentication or valuable access; it simply delivers a crafted POST to the exposed AJAX endpoint tcp_register_and_login_ajax. If the site is publicly accessible, an outside attacker can immediately exploit it, making the risk highly actionable. This straightforward, unauthenticated path, coupled with the high CVSS, indicates that sites should prioritize remediation.