Attack Chain

1. An unauthenticated attacker identifies a WordPress site running TheCartPress version 1.5.3.6.
2. The attacker crafts a POST request targeting the tcp_register_and_login_ajax action.
3. The POST request includes the tcp_role parameter set to administrator.
4. The attacker sends the crafted POST request to the WordPress site’s AJAX handler (/wp-admin/admin-ajax.php).
5. The vulnerable code in TheCartPress plugin processes the request without proper authentication or authorization checks.
6. A new administrator account is created with the credentials specified in the POST request.
7. The attacker logs in to the WordPress site using the newly created administrator account.
8. The attacker gains full control over the WordPress site, including the ability to modify content, install plugins, and manage users.

Impact

Successful exploitation of CVE-2021-47932 allows attackers to gain complete administrative control over the affected WordPress site. This can lead to website defacement, data theft, malware distribution, and further compromise of the server. The impact is critical due to the ease of exploitation and the high level of access gained.

Recommendation

• Apply available patches or updates for TheCartPress plugin if available from the vendor.
• Deploy the Sigma rule to detect POST requests to /wp-admin/admin-ajax.php with tcp_register_and_login_ajax action and tcp_role set to administrator.
• Monitor web server logs for suspicious POST requests to the AJAX handler.
• Implement web application firewall (WAF) rules to block requests exploiting CVE-2021-47932.