CVE-2026-13598
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The RestrictMate WordPress plugin before version 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Risk Assessment
An unauthenticated attacker can gain full control of the WordPress site, potentially leading to complete compromise of the website and data.
Recommendation
Update the RestrictMate plugin to version 1.3.0 or later, which fixes the role control issue.
Original NVD description (English source)
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.