← back to popular plugins
wordfence / plugin · breadcrumb-navxt
Breadcrumb NavXT
breadcrumb-navxt
total installs
800,000
total vulns
1
critical
0
high
0
medium
1
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities
(1)
Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
medium
✓ patched
cve id
CVE-2025-13842 ↗
cvss score
5.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Feb 18, 2026
The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.