Newpath Wildapricotpress Add On
Monthly
Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.
Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.