CVE-2026-13736

MEDIUM CVSS 5.3 View on NVD ↗

Description

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/

Published: Aug 21, 2026 07:16 UTC Modified: Aug 21, 2026 13:16 UTC