medium5.3
CVE-2026-13736
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing a…
Impact
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
Affected products
| Product | Affected versions |
|---|---|
| NewPath WildApricotPress Add-On WordPress Plugin | through 1.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.