WordPress Plugin CVE-2026-13736 Exposes Member PII to Unauthenticated Users

·2 views

A medium-severity vulnerability, CVE-2026-13736, has been identified in the NewPath WildApricotPress Member Directory WordPress plugin up to and including version 1.0.0. Discovered by cybersecurity researcher Huynh Kien Minh, the flaw stems from a publicly accessible REST API endpoint that lacks proper access controls. Because the backend serializes raw member data without filtering restricted fields, unauthenticated visitors can retrieve private emails, phone numbers, and other members-only profile attributes. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium) and is classified under CWE-284 and CWE-200, relating to improper access control and information exposure. Minh recommends immediate remediation through REST endpoint permission hardening, field-level privacy checks, and sanitization of JSON API responses.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GetBirthChart Astrology Engine Now Available as Python Package on PyPI

The calculation engine behind GetBirthChart, an astrology platform, has been packaged and published to PyPI as gbc-astro, installable via pip. Previously, using the open-source engine required cloning the repository and configuring the environment manually. The package wraps the same underlying engine — powered by Swiss Ephemeris — without introducing separate astrology logic, covering planetary positions, house systems, aspects, and retrograde states. A key design feature is its handling of unknown birth times: rather than substituting a default value, the library omits time-dependent outputs like the Ascendant and houses. Optional API dependencies for FastAPI integration are available separately, keeping the core package lightweight.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solana Cuts Account Rent by 90% via SIMD-0437, Raising Value of Old Deposits

Solana's SIMD-0437 proposal, shipping with Agave 4.2, reduces the lamports-per-byte storage rate from 6,960 to 696 across five phased reductions, cutting the cost to open a standard token account from roughly 0.002 SOL to 0.0002 SOL. The change began rolling out on mainnet in late August 2026 and significantly lowers capital requirements for bulk account creation such as airdrops, which previously locked around 20 SOL for 10,000 recipients. Because the update is a relaxation rather than a forced adjustment, all accounts created before activation still return their original higher deposit when closed, making pre-activation accounts worth ten times more per close than new ones. This creates a finite, non-replenishing inventory of higher-value reclaimable SOL sitting in millions of empty token accounts, failed program deploy buffers, and leftover wrapped SOL accounts. Users and developers stand to recover meaningful SOL by closing these legacy accounts before they are forgotten entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Agent State, Memory, and Checkpointing Overlap in AI System Design

In AI agent development, state, memory, and checkpointing are distinct concepts that frequently overlap in practice, making their boundaries difficult to define cleanly. State tracks an agent's current execution context, while checkpointing persists that state so a process can resume after interruption. This persisted state functionally provides short-term memory within a conversation thread, but does not automatically create long-term memory. Long-term memory requires a deliberate selection step, where the application identifies which information from an interaction is worth retaining for future use. Systems like LangGraph reflect this architectural separation by using a checkpointer for thread-level state and a separate store for cross-thread persistent information.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Database Partitioning and Sharding Explained: Scaling Data Across Servers

As applications grow to serve millions of users, a single database server can become a performance bottleneck due to slow queries, high CPU usage, and storage limits. Vertical scaling — upgrading to a more powerful server — has physical and practical limits, making it insufficient for large-scale systems. Database partitioning addresses this by splitting large datasets into smaller chunks called partitions, using strategies such as range, hash, or list-based rules. Hash partitioning uses a hash function to distribute data evenly across partitions, while range partitioning divides data by value intervals such as user ID ranges or date periods. Sharding extends this concept further by distributing partitions across multiple independent database servers, enabling true horizontal scaling for massive datasets.

0 comments Read more at DEV Community