Open REST route in WildApricotPress Member Directory hands out members-only emails and phones

The interesting part is where the privacy check was supposed to live and where it actually did not. According to Huynh Kien Minh's write-up, WildApricot lets a member decide field by field whether a phone number or email is shown to non-members, and the plugin's frontend honored that choice by hiding the values in the directory cards ^[7]. The backend did not ^[6]. The callback `newpath_wap_get_member_directory` pulled the member records and serialized the raw objects straight into the JSON response, restricted fields included ^[5][6].

That gap only matters because the route was open. The plugin registered its directory endpoint with `permission_callback` set to `__return_true` ^[4]. In WordPress that string is the standard shortcut for "anyone may call this," and it is the usual way developers let async frontend JavaScript pull data without a login ^[4]. It also means a plain HTTP GET from a stranger gets the same response the page's own script would ^[8].

The proof-of-concept the researcher published is a short request loop: point it at `/wp-json/newpath-wap/v1/directory`, read the JSON, print names, emails and phones ^[12]. There is no authentication step to defeat because there is no authentication ^[4].

The CVSS 3.1 rating is 5.3, a medium ^[2]. That reads low for a bug that returns contact details a member specifically asked to keep private ^[8]. The score reflects that this is read-only disclosure, not write access or code execution; it does not reflect what a full member roster is worth to someone building a phishing list ^[2][9].

Kien Minh's remediation is the obvious one: check capability and per-field privacy on the server before the object is serialized, not after it reaches the browser ^[10]. For operators the instruction is narrower. Move past 1.0.0 ^[1][10]. Because the missing check sits in code rather than configuration, no directory setting will close the route, and any site that cannot confirm a fixed build is installed is left with disabling the plugin as its only other control.

The account so far is one researcher's, published on dev.to, pointing to a WPScan verified advisory and an NVD entry under the same CVE identifier ^[11][3]. That is worth noting before you treat the downstream language, phishing and credential stuffing, as settled rather than plausible ^[9].