WordPress RestrictMate Plugin Admin Takeover

The RestrictMate WordPress plugin, versions prior to 1.3.0, has a critical vulnerability.

RestrictMate does not validate or restrict the user role during account registration, allowing unauthenticated attackers to create a new administrator account.

Exploitation of this vulnerability leads to a full site takeover.