Unauthenticated PII Disclosure in NewPath WildApricotPress WordPress Plugin

CVE-2026-13736 is an unauthenticated information disclosure vulnerability in the NewPath WildApricotPress Add-on - Member Directory for WordPress (version 1.0.0 and below). The plugin registers a custom REST API endpoint, /wp-json/newpath-wap/v1/directory, which is intended to display member information. However, the endpoint defines its permission_callback as __return_true, explicitly allowing unauthenticated access. Furthermore, the backend implementation fails to apply field-level privacy filtering, serializing raw member objects that include sensitive PII such as email addresses, physical addresses, and phone numbers. An attacker can exploit this flaw by sending a standard HTTP GET request to the vulnerable endpoint, potentially harvesting the entire member database. This vulnerability poses a significant risk to the privacy of members associated with organizations utilizing this plugin.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running the NewPath WildApricotPress Add-on.
2. Attacker confirms the presence of the vulnerable endpoint at /wp-json/newpath-wap/v1/directory.
3. Attacker sends an unauthenticated HTTP GET request to the target REST endpoint.
4. The WordPress REST server processes the request, bypassing authentication due to the insecure permission_callback.
5. The plugin code executes newpath_wap_get_member_directory to fetch raw data.
6. The backend retrieves the full member record set without checking user session privileges.
7. The server responds with a JSON payload containing raw PII fields.
8. Attacker parses the JSON output to collect and store the scraped PII.

Impact

Successful exploitation results in the unauthorized mass exfiltration of sensitive member information, including names, personal emails, physical addresses, and contact phone numbers. This can lead to increased targeted phishing campaigns against the membership base, potential GDPR or other regulatory compliance violations for the host organization, and loss of trust in the platform.

Recommendation

• Update the NewPath WildApricotPress Add-on - Member Directory plugin to the latest version, which enforces proper authentication and data serialization.
• Implement the Sigma detection rule below to identify unauthorized access attempts to the vulnerable REST endpoint.
• If an update is not immediately feasible, use a web application firewall or server configuration to block unauthenticated requests to /wp-json/newpath-wap/v1/directory.