What is the CVSS score of EUVD-2026-63813?

EUVD-2026-63813 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-63813?

Yes, a public proof-of-concept exploit is available for EUVD-2026-63813. Prioritise patching immediately. EPSS: 0.1%.

WildApricotPress Add-on EUVD-2026-63813

| CVE-2026-13736 MEDIUM

Improper Access Control (CWE-284)

2026-08-21 WPScan

GHSA-85gf-5q4q-3355

WordPress Authentication Bypass Newpath Wildapricotpress Add On Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network-accessible REST endpoint with no preconditions; impact is partial read of member contact fields only, no write or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 13:23 vuln.today

CVSS changed

Aug 21, 2026 - 13:22 NVD

5.3 (MEDIUM)

CVE Published

Aug 21, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Aug 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

AnalysisAI

Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The target WordPress installation must have the NewPath WildApricotPress Add-on plugin activated in a version at or below 1.0.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) accurately characterizes a remotely exploitable, zero-condition, unauthenticated read-only flaw with limited confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis for any version of the NewPath WildApricotPress Add-on; the CPE vendor field being listed as 'unknown' in NVD further suggests no coordinated disclosure response has occurred. … Detailed patch versions, workarounds, and compensating controls in full report.