CVE-2026-13736: WildApricotPress Information Disclosure

CVE-2026-13736 Overview

CVE-2026-13736 is an improper access control vulnerability [CWE-284] in the NewPath WildApricotPress Add-on WordPress plugin through version 1.0.0. The plugin exposes an unauthenticated REST API route that fails to enforce members-only field privacy settings. Anonymous visitors can read member email addresses and phone numbers even when the plugin is configured to restrict those fields to logged-in members. The issue affects site operators using the plugin to synchronize WildApricot association data with WordPress member directories.

Critical Impact
Unauthenticated attackers can harvest member email addresses and phone numbers from affected WordPress sites, enabling downstream phishing and spam campaigns.

Affected Products

NewPath WildApricotPress Add-on WordPress plugin, versions up to and including 1.0.0

Discovery Timeline

2026-08-21 - CVE-2026-13736 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13736

Vulnerability Analysis

The WildApricotPress Add-on exposes a REST API route that returns member records serialized from the WildApricot backend. The plugin allows administrators to mark specific member fields, such as email addresses and phone numbers, as visible only to authenticated members. However, the REST route handler does not evaluate this privacy configuration before serializing responses.

When an unauthenticated HTTP client queries the endpoint, the plugin returns the full member payload including fields marked as members-only. This turns a controlled internal directory into a public data source reachable over the network.

The weakness maps to CWE-284 (Improper Access Control). The plugin performs authentication for administrative operations but does not gate field-level disclosure on the read path.

Root Cause

The root cause is missing authorization logic on the REST route that returns member profile data. Privacy metadata attached to member fields is stored and honored by the plugin's front-end rendering functions but is not consulted by the REST controller. As a result, server-side field filtering never occurs before the JSON response is returned.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an unauthenticated HTTP GET request to the plugin's REST endpoint and parses the returned JSON payload for email and phone fields. No user interaction, credentials, or configuration prerequisites beyond the plugin being installed and active are required. Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-13736

Indicators of Compromise

Unauthenticated GET requests to WordPress REST routes registered by the WildApricotPress Add-on plugin
Bulk enumeration patterns hitting /wp-json/ paths associated with the plugin from a single client IP
Outbound spam or phishing complaints referencing email addresses that only appear in the members-only directory

Detection Strategies

Review WordPress and reverse-proxy access logs for anonymous requests to plugin-registered REST namespaces returning large JSON payloads
Alert on repeated requests to /wp-json/ routes with response sizes inconsistent with public content
Correlate anonymous REST access with subsequent inbound authentication attempts against member accounts

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a central analytics platform for retention and search
Track baseline request volume for plugin REST routes and alert on deviations
Monitor WordPress plugin inventory to detect installations of vulnerable versions across managed sites

How to Mitigate CVE-2026-13736

Immediate Actions Required

Identify all WordPress sites running the NewPath WildApricotPress Add-on plugin at version 1.0.0 or earlier
Deactivate the plugin on affected sites until a fixed version is installed
Rotate any member communications workflows that assumed the exposed data was private, and notify affected members if applicable

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Site operators should monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for an updated release, and apply it immediately once published.

Workarounds

Block unauthenticated access to the plugin's REST routes at the web server or web application firewall layer
Restrict the WordPress REST API to authenticated users where feasible, using a REST authentication plugin or custom rest_authentication_errors filter
Remove sensitive fields such as phone number from the WildApricot-to-WordPress synchronization configuration until a patch is available

bash

# Example nginx rule to block unauthenticated access to the plugin REST namespace
# Replace <plugin-namespace> with the actual namespace observed in traffic
location ~ ^/wp-json/<plugin-namespace>/ {
    if ($http_authorization = "") {
        return 403;
    }
}