CVE-2026-13598: RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/RestrictMateto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs unauthenticated access to the affected site's account-registration functionality. They can supply an administrator role during registration, create an administrator account, and obtain an authenticated administrator session.
Which deployments are affected?
RestrictMate versions before 1.3.0 are affected where account registration is available through the plugin. The provided information does not identify any additional configuration prerequisite.
How can I check whether a site may have been exploited?
Review WordPress user accounts for unexpected administrator users, especially accounts created through registration activity. Also review administrator login and account-creation records for unfamiliar sessions or newly created privileged accounts.