EUVD-2026-64635
GHSA-vmqg-pqj8-5w8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach WordPress registration endpoint
-
DeliverySubmit signup with role=administrator
-
ExploitPlugin fails to restrict role
-
InstallAdmin account created, session granted
-
C2Install malicious plugin / edit theme
-
ExecuteExecute PHP as web server
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the RestrictMate plugin (version below 1.3.0) installed and active AND that user self-registration is enabled, since the flaw lives in the account-registration flow that fails to restrict the supplied user role. Given CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client position are needed against such a configuration. The main limiting factor is deployment-specific: sites that disable public registration or do not run RestrictMate are not exploitable, which meaningfully narrows the real-world exposed population despite the maximal CVSS metrics. |
| Impact | The signals mostly align toward high urgency but with an important nuance. CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N - remote, low-complexity, unauthenticated, no user interaction - and CISA SSVC rates it Automatable=yes with Technical Impact=total, meaning a single scripted request can fully compromise a site. Against that, EPSS is only 0.19% (8th percentile), it is not listed on CISA KEV, and no public exploit has been identified yet, so observed exploitation pressure is currently low. The most likely reconciliation is that this is a genuinely dangerous but recently disclosed niche-plugin bug that has not yet been widely weaponized; the low EPSS reflects limited plugin footprint and no released PoC rather than any technical difficulty. Note one caveat worth verifying: the intelligence tags label this 'Information Disclosure', which conflicts with the description's full-takeover impact - treat the CWE-269 privilege-escalation description as authoritative. Given automatability and total impact, any operator running RestrictMate with open registration should treat patching as urgent rather than deferring on the strength of the low EPSS number alone. |
| Exploit ScenarioDerived | An attacker browses to the target WordPress site's registration page and submits a normal registration request, adding a crafted role field set to 'administrator'; the plugin honors it and provisions an admin account, returning a logged-in administrator session. From there the attacker installs a malicious plugin or edits theme PHP to gain code execution and full server-side control. No public PoC has been identified yet, but the low attack complexity (AC:L) and lack of authentication or user interaction make reliable exploitation straightforward once the parameter is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Unauthenticated privilege escalation to administrator in the RestrictMate WordPress plugin before 1.3.0 lets any remote visitor abuse the account-registration flow, which fails to validate the user role submitted during signup, to create a brand-new administrator account and receive a logged-in admin session - resulting in full site takeover. Rated CVSS 9.8 with a fully remote, no-interaction, no-privilege vector; a vendor patch (1.3.0) exists and CISA's SSVC framework flags it as automatable with total technical impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, and EPSS is low at 0.19% (8th percentile).
RemediationAI
Vendor-released patch: 1.3.0 - upgrade the RestrictMate plugin to version 1.3.0 or later immediately, as this is the primary and confirmed fix. If you cannot patch right away, the most effective compensating control is to disable new user self-registration in WordPress (Settings → General, uncheck 'Anyone can register'), which removes the attack surface but also blocks legitimate signups; alternatively, deactivate the RestrictMate plugin entirely until it can be updated, accepting loss of whatever access-restriction functionality it provides. As a stopgop, a WAF rule that blocks or strips any 'role' (or equivalent capability) parameter on the registration endpoint can help, though it depends on knowing the exact parameter name and may break legitimate flows. After patching, audit wp_users/wp_usermeta for unexpected administrator accounts created since deployment and rotate credentials. Refer to the WPScan advisory (https://wpscan.com/vulnerability/05fd8e45-92fa-4ed4-ae59-9a7b7743ea34/) for authoritative details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is RestrictMate, a WordPress plugin, running inside the WordPress registration subsystem. The root cause is CWE-269 (Improper Privilege Management): the plugin trusts a client-supplied role parameter during account registration instead of forcing the default subscriber role server-side, so an attacker can specify 'administrator' and have WordPress provision a full-privilege account. Because WordPress admin accounts control plugins, themes, users, and can execute PHP via theme/plugin editors, obtaining one is equivalent to complete application compromise. This is a classic mass-assignment / missing role-whitelist flaw in a registration handler rather than a memory-safety or protocol bug.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote registration abuse with no interaction (AV:N/AC:L/PR:N/UI:N) yields an administrator account, giving total confidentiality, integrity, and availability impact on the site.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.
Executive ViewAI
The RestrictMate WordPress plugin (versions prior to 1.3.0) contains a critical, unauthenticated privilege escalation flaw allowing any internet visitor to create unauthorized administrator accounts and achieve complete site takeover. No public exploit has been identified at time of analysis, but the vulnerability is technically automatable and creates immediate risk of data breach, operational disruption, and potential regulatory exposure. A vendor patch (version 1.3.0) exists and requires urgent deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB