Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-13598 The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a n… https://www.cve.org/CVERecord?id=CVE-2026-13598
Post summary
The CVE notes that RestrictMate WordPress plugin (<1.3.0) fails to enforce user role restrictions during registration, giving unauthenticated users the ability to create accounts.
CVE-2026-13598 Unauthenticated Administrator Account Creation in RestrictMate Wo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13598 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet references CVE-2026-13598, noting a vulnerability that permits unauthenticated administrator account creation in RestrictMate, but does not provide further technical details, exploitation evidence, or remediation information.