Deep-Dive Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Member Directory PII Disclosure

CVE-2026-13736 is a newly discovered vulnerability affecting the NewPath WildApricotPress Add-on – Member Directory WordPress plugin, specifically versions 1.0.0 and earlier. This flaw, identified and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK), allows unauthenticated remote visitors to access Personally Identifiable Information (PII) of members, including private email addresses, phone numbers, and other restricted fields.

The vulnerability exists due to the plugin's custom WordPress REST API routing architecture which fails to enforce privacy access controls on restricted fields. This means that any unauthenticated threat actor can send a simple direct HTTP GET request to the exposed REST route and retrieve confidential member data. This sensitive data exposure violates expected privacy boundaries and enables targeted phishing, credential stuffing, and unauthorized profiling across affected organizations.

The root cause of the issue lies in the plugin's misuse of the `register_rest_route()` function in WordPress. The plugin sets `permission_callback = __return_true` for the member directory endpoint, allowing anyone to access the data. However, despite this, the backend callback `newpath_wap_get_member_directory()` serializes the raw member object into the JSON response without filtering out the restricted fields. As a result, any unauthorized user can retrieve the unredacted dataset.

To exploit this vulnerability, an attacker can use the provided PoC exploit code written in Python. This script sends an unauthenticated GET request to the vulnerable REST endpoint, retrieves the exposed member records, and prints out the name, email, and phone number for the first three records. The script includes a user agent string identifying the researcher as Huynh Kien Minh.