CVE-2026-13736 NewPath CVE debrief

Who should care

Users of the NewPath WildApricotPress Add-on WordPress plugin, especially those with sensitive member information, should be aware of this vulnerability and take necessary actions to protect their member data. This includes reviewing the plugin version, restricting access to sensitive information, and monitoring for potential exploitation attempts. Additionally, operators, platform administrators, and security teams may need to review and update their security measures to mitigate the impact of this vulnerability.

Technical summary

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only. This vulnerability affects users of the plugin who have sensitive member information. The issue is related to the plugin's handling of REST routes and member data privacy.

Defensive priority

Members-only field privacy not enforced on unauthenticated REST route.

Recommended defensive actions

• Verify the NewPath WildApricotPress Add-on WordPress plugin version and update if necessary.
• Restrict access to sensitive member information.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

CVE-2026-13736 details are based on limited information from the CVE and NVD records. Further investigation is recommended to fully understand the vulnerability. The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only. Defenders should verify the plugin version, review member information exposure, and monitor for potential exploitation attempts.

Official resources