CVE-2026-13598 RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
Unauthenticated attackers can register as administrators due to missing role restrictions, leading to full site takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13598?
CVE-2026-13598 is a critical vulnerability in Unknown RestrictMate, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Weakness: CWE-269
Which versions are affected by CVE-2026-13598?
How do I fix CVE-2026-13598?
No fix has been published for CVE-2026-13598 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13598 being exploited?
There is no known exploitation of CVE-2026-13598 in the wild and no public exploit code.
Sources
Also known as GHSA-vmqg-pqj8-5w8h.