Description

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T07:16:24.323Z",
  "pubdate": "2026-08-21T07:16:24.323Z",
  "executiveSummary": "The NewPath WildApricotPress Add-on WordPress plugin through version 1.0.0 suffers from an access control bypass vulnerability affecting its members-only field privacy configurations. The root cause lies in an exposed REST route that fails to properly enforce authentication and authorization checks, thereby ignoring the administrative intent to restrict sensitive user metadata visibility to authenticated members only.\nThe primary impact of this security defect is the unauthorized disclosure of personally identifiable information (PII), specifically member email addresses and phone numbers. Anonymous, unauthenticated remote attackers can query the vulnerable REST API endpoint directly to harvest sensitive data associated with registered site members.\nThis vulnerability presents a significant privacy risk and potential compliance violation regarding data protection regulations. Exploitation requires no prior privileges, specialized access credentials, or user interaction, as the attack surface is exposed over the network via standard HTTP requests to the affected REST route.\nOrganizations utilizing the NewPath WildApricotPress Add-on plugin in versions 1.0.0 and earlier are exposed to information disclosure risks until a secure patch restricting route access is applied.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the NewPath WildApricotPress Add-on WordPress plugin through version 1.0.0. Specifically, the plugin registers a custom REST route designed to retrieve member profile data. However, the underlying controller or callback function handling the HTTP request fails to validate whether the incoming request originates from an authenticated session or a user possessing appropriate membership privileges.\nIn a secure implementation, endpoints handling sensitive fields such as member email addresses and phone numbers enforce strict permission callbacks via the WordPress REST API framework (e.g., utilizing `permission_callback` checks). In this vulnerable component, the authorization check is either omitted or improperly implemented, allowing anonymous actors to bypass the intended privacy boundary enforced in the standard WordPress front-end or dashboard views.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker identifies or enumerates the exposed REST route endpoint provided by the NewPath WildApricotPress Add-on plugin. 2) The attacker crafts an HTTP GET or POST request targeting this unauthenticated endpoint. 3) The server processes the request without validating session tokens, cookies, or user roles. 4) The plugin queries the database or internal data structures and returns a JSON response containing member records, including fields explicitly configured by administrators to be restricted to members only. 5) The attacker receives the payload containing sensitive attributes such as private email addresses and telephone numbers, facilitating subsequent social engineering, spam campaigns, or targeted reconnaissance."
}