Unauthenticated Access to Member Data in WildApricotPress Add-on

Executive Summary

The NewPath WildApricotPress Add-on WordPress plugin through version 1.0.0 has a vulnerability where it does not enforce privacy settings for member data. This allows unauthenticated users to access member email addresses and phone numbers via an unauthenticated REST route, even though these details are meant to be visible only to logged-in members.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'NewPath WildApricotPress Add-on' version 1.0.0 or below is installed. Use WPScan to scan for vulnerable plugins with: wpscan --url [your-site-url] --enumerate vp,vt. Alternatively, manually inspect REST API endpoints for member data exposure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability exposes personally identifiable information (PII) of members, such as email addresses and phone numbers, to unauthorized users. Attackers could harvest this data for phishing, spam, or other malicious activities, potentially leading to privacy breaches and reputational damage for the website owner.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates privacy regulations like GDPR and HIPAA by exposing PII without proper access controls. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Unauthorized disclosure could result in legal penalties and compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the 'NewPath WildApricotPress Add-on' plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Monitor the plugin's official repository for security fixes.

Useful 0 Not Useful 0