CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Affected products

Wildapricotpress Add-On

CVSS 3.1

5.3 MEDIUM

EPSS

0.2% (15th percentile)

Weakness

CWE-284

NVD status

Deferred

Published

2026-08-21