Advisory Overview

CVE-2026-13736 is an unauthenticated Personally Identifiable Information (PII) disclosure vulnerability affecting the NewPath WildApricotPress Add-on – Member Directory WordPress plugin. The flaw impacts versions prior to and including 1.0.0. Cybersecurity researcher Huynh Kien Minh, also known as MinhHK, discovered and analyzed the vulnerability. The issue resides within the plugin's custom WordPress REST API endpoints, allowing unauthorized access to sensitive member data.

The CVSS score for this vulnerability is 5.3 (Medium), indicating a moderate risk. However, the implications for affected organizations and their members are significant, as PII can be exploited for various malicious purposes, including phishing, identity theft, and further targeted attacks. The WPScan advisory has verified this report, and a National Vulnerability Database (NVD) entry is available for CVE-2026-13736.

Vulnerability Details

The core of CVE-2026-13736 lies in how the WildApricotPress plugin handles data retrieval through its custom REST API endpoints. Specifically, the plugin fails to implement proper authorization checks before exposing member directory information. This oversight means that any unauthenticated user, even someone who has not logged into the WordPress site, can craft specific API requests to retrieve sensitive data associated with members listed in the directory.

The type of PII exposed can vary depending on how the plugin is configured and what fields are populated by the site administrator. However, common PII fields that could potentially be disclosed include:

  • Full Names
  • Email Addresses
  • Phone Numbers
  • Physical Addresses
  • Membership Details
  • Other custom fields populated within the directory.

The lack of authentication bypasses standard WordPress security measures, effectively turning a private member directory into an open book for anyone aware of the vulnerability. This is particularly concerning for organizations that use WildApricotPress to manage membership lists for clubs, associations, or professional groups, where privacy is often a key expectation.

Technical Analysis

Huynh Kien Minh's research indicates that the vulnerability stems from insecure implementation within the plugin's REST API. WordPress's REST API allows for programmatic interaction with a WordPress site, enabling the creation, reading, updating, and deletion of data. Plugins often leverage this API to provide extended functionality. In the case of WildApricotPress, it appears that certain endpoints designed to fetch member data were not adequately protected.

An attacker can exploit this by sending HTTP requests to specific API endpoints. For instance, a request might look something like /wp-json/wildapricotpress/v1/members or a similar path. Without a check to verify if the requester is authenticated and authorized to view this information, the plugin simply returns the requested data. This is akin to leaving a filing cabinet unlocked and accessible from the street, with sensitive documents inside.

The specific function or method within the plugin's codebase responsible for this data exposure would need to be analyzed in detail by developers. However, the outcome is consistent: unauthorized access to member PII. The fact that it is unauthenticated means that no credentials, session tokens, or user roles are required, making it a straightforward attack vector.

Impact and Mitigation

The immediate impact of CVE-2026-13736 is the potential for widespread PII leakage from affected WordPress sites. This can severely damage the trust between an organization and its members, leading to reputational damage and potential legal repercussions, especially under data privacy regulations like GDPR or CCPA.

The primary mitigation strategy for this vulnerability is to update the NewPath WildApricotPress Add-on – Member Directory plugin to a version that addresses the flaw. As of the advisory, versions prior to and including 1.0.0 are affected. Users should ensure they are running the latest available version, which, according to the WPScan advisory, is version 1.0.1, released to patch this specific issue.

For site administrators who cannot immediately update the plugin, temporary workarounds might include:

  • Disabling the WildApricotPress Member Directory feature if it is not critical.
  • Implementing strict firewall rules that block access to WordPress REST API endpoints if possible, though this can affect legitimate plugin functionality.
  • Monitoring web server logs for suspicious API requests targeting the WildApricotPress endpoints.

However, updating the plugin remains the most effective and recommended solution. Developers of the plugin have addressed the security flaw, and users must apply the patch to protect their data.

Disclosure Timeline

While a precise disclosure timeline was not detailed in the excerpt, the existence of a CVE ID, a WPScan advisory, and an NVD entry indicates a formal vulnerability disclosure process has been followed. Typically, this involves the researcher reporting the vulnerability to the vendor, who then develops and releases a patch before public disclosure. The information available suggests that this process has concluded with the release of a patched version and public advisories.

Conclusion

CVE-2026-13736 represents a significant security risk for users of the NewPath WildApricotPress Add-on – Member Directory plugin. The unauthenticated PII disclosure vulnerability, discovered by Huynh Kien Minh, underscores the importance of regular plugin updates and diligent security practices for WordPress sites. Organizations relying on this plugin should prioritize updating to version 1.0.1 or later immediately to safeguard their members' personal information.