Member Privacy Flaw in NewPath WildApricotPress Add-on for WordPress
CVE-2026-13736

Currently unrated

Key Information:

Vendor

WordPress
Status
NeWPath Wildapricotpress Add-on
Vendor
CVE Published:
21 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13736?

The NewPath WildApricotPress Add-on for WordPress, up to version 1.0.0, has a vulnerability that fails to protect the privacy of members' fields. This issue allows unauthenticated users to access sensitive information, namely member email addresses and phone numbers, that should only be visible to authorized members. This misconfiguration on an unsecured REST route compromises member privacy and poses significant data security risks.

Affected Version(s)

NewPath WildApricotPress Add-on 0 <= 1.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13736 - Proof of Concept

References

https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Huynh Kien Minh
WPScan
.