CVE-2026-13736 is an unauthenticated Personally Identifiable Information (PII) disclosure vulnerability affecting the NewPath WildApricotPress Add-on – Member Directory WordPress plugin, versions 1.0.0 and earlier. Discovered by Huynh Kien Minh, this medium-severity flaw (CVSS 5.3) allows public access to private member data. The vulnerability resides in the plugin's REST API, specifically where member directory endpoints fail to enforce privacy controls. An insecure permission callback, set to '__return_true', allows unauthenticated users to query the API. The backend callback, 'newpath_wap_get_member_directory()', serializes raw member objects without filtering restricted fields. This exposes confidential information like email addresses, phone numbers, and private membership attributes. Consequently, unauthenticated attackers can harvest sensitive data, enabling phishing and unauthorized profiling. Remediation involves updating the plugin to a version greater than 1.0.0. Developers must implement server-side field-level capability and privacy checks before serializing member objects into REST responses. Huynh Kien Minh specializes in WordPress vulnerability analysis and API security.