CVE-2026-13736

NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Affected

NewPath WildApricotPress Add-on

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2026-08-21

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/
• MinhHK68/CVE-2026-137360★ · 2026-08-22

References

• CVE Record
• NVD entry

Related

• CVE-2026-13157
• CVE-2026-13158