The NewPath WildApricotPress Add‑on for WordPress allows unauthenticated users to call a REST endpoint that returns members’ email addresses and phone numbers even though those fields are configured to be visible only to logged‑in members. As a result, personal identifying information belonging to site members can be exposed to anyone on the internet without authentication.

The vulnerability impacts any website running the NewPath WildApricotPress Add‑on on or before version 1.0.0. No other vendors or products are listed.

The CVSS score is not provided, but the absence of authentication on a publicly exposed REST route means that exploitation is trivial for anyone with internet access to the site. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is effectively network with no special privileges, making disclosure highly likely if the site uses the affected plugin.