CVE-2026-13736CWE-284broken-access-control

CVE-2026-13736

Medium · published August 21, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-21T11:16Z
References (1)
https://wpscan.com/vulnerability/97fe9780-ad69-4f36-9496-5ca9c0e2bc39/ · [email protected]
EPSS history
Timeline
  • 21 AUG 06:00Z
    NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
    cvelistv5