Quick answers
- Is CVE-2026-13598 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13598 being exploited in the wild.
- How severe is CVE-2026-13598?
- Critical severity, with a CVSS score of 9.8, published 23 August 2026.
- Which products and versions are affected?
- Automattic RestrictMate before 1.3.0.
- Is there a fix for CVE-2026-13598?
- A patch was published on 2026-08-21: Fixed in version 1.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13598 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-13598?
- Check whether you run Automattic RestrictMate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a privilege escalation due to improper input validation in the user registration AJAX endpoint (action=restrictmate_registration). The plugin accepts a user-supplied "role" parameter during registration without restricting it to safe defaults, allowing an attacker to set role=administrator. The registration nonce is public and tied to the anonymous user (uid 0), making it scrapeable from the public /register page. An unauthenticated attacker can obtain the nonce, POST a crafted registration request with administrator privileges, and receive a logged-in session cookie immediately upon success. Fixed in version 1.3.0, which enforces a subscriber role regardless of the supplied role parameter.
Affected products
- Automattic RestrictMate before 1.3.0
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Fixed in version 1.3.0