CVE-2026-13736 — NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

CVE-2026-13736

NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API PUBLISHED

Description (CNA)

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Affected (CNA)

Vendor / product	Versions
Unknown / NewPath WildApricotPress Add-on	affected 0 through 1.0.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.