WordPress Plugin Vulnerabilities

RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator

Description

The plugin does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.

Proof of Concept

Affects Plugins

Plugin icon
restrictmate
Fixed in 1.3.0

References

CVE
CVE-2026-13598

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
05fd8e45-92fa-4ed4-ae59-9a7b7743ea34

Timeline

Publicly Published
2026-08-21 (about 23 days ago)
Added
2026-08-21 (about 22 days ago)
Last Updated
2026-09-09 (about 3 days ago)

Other

Published
Title
Published
2024-12-18
Title
AI Magic < 1.0.6 - Unauthenticated Privilege Escalation
Published
2026-02-18
Title
Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation
Published
2025-10-02
Title
Appy Pie Connect for WooCommerce <= 1.1.2 - Unauthenticated Privilege Escalation
Published
2026-03-20
Title
RewardsWP < 1.0.5 - Unauthenticated Privilege Escalation
Published
2025-04-16
Title
Xelion Webchat < 9.2.0 - Authenticated (Subscriber+) Privilege Escalation