The RestrictMate WordPress plugin fails to constrain the user role supplied during account registration, allowing any unauthenticated visitor to create a new administrator account. By exploiting this flaw, an attacker can obtain a logged‑in administrator session without knowing any existing credentials, effectively giving them full control of the site.

WordPress sites that have the RestrictMate plugin installed in any version earlier than 1.3.0 are affected. The vulnerability exists because all versions before the 1.3.0 release do not properly restrict the role field during registration.

The flaw permits direct privilege escalation through the standard WordPress registration endpoint, so an attacker does not need to compromise any existing account. While the EPSS score is not available, the lack of authentication requirements and the ease of creating a privileged account imply that the vulnerability poses a high operational risk. It is not listed in the CISA KEV catalog, but the potential for full site takeover requires timely attention.