critical9.8
CVE-2026-13598
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to crea…
Impact
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Affected products
| Product | Affected versions |
|---|---|
| RestrictMate WordPress Plugin | before 1.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.