The RestrictMate WordPress plugin fails to constrain the user role supplied during account registration, allowing any unauthenticated visitor to create a new administrator account. By exploiting this flaw, an attacker can obtain a logged-in administrator session without knowing any existing credentials, effectively giving them full control of the site. This vulnerability is an example of elevation of privilege (CWE-269).

WordPress sites that have the RestrictMate plugin installed in any version earlier than 1.3.0 are affected. The vulnerability exists because all versions before the 1.3.0 release do not properly restrict the role field during registration.

The flaw permits direct privilege escalation through the standard WordPress registration endpoint, so an attacker does not need to compromise any existing account. The CVSS score of 9.8 highlights the high severity of this vulnerability. The EPSS score of less than 1% indicates a low but nonzero exploitation probability, and the lack of authentication requirements and the ease of creating a privileged account imply that the vulnerability poses a high operational risk. It is not listed in the CISA KEV catalog, but the potential for full site takeover requires timely attention.