PT-2026-20607 · WordPress · Breadcrumb Navxt

Nosleep · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2025-13842

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Breadcrumb NavXT versions prior to 7.5.1

Description The Breadcrumb NavXT plugin for WordPress has an authorization bypass issue. This occurs because the Gutenberg block renderer trusts the post id parameter without proper verification within the includes/blocks/build/breadcrumb-trail/render.php file. An attacker can manipulate the post id parameter to enumerate and view breadcrumb trails for draft or private posts, potentially revealing post titles and hierarchy that should not be accessible. The vulnerable parameter is post id.

Recommendations Update Breadcrumb NavXT to version 7.5.1 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-13842

Produtos afetados

Breadcrumb Navxt

Referências · 5

• https://plugins.trac.wordpress.org/browser/breadcrumb-navxt/trunk/includes/blocks/build/breadcrumb-trail/render.php#L17 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13842 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3425008 · Nota
• https://twitter.com/CVEnew/status/2024501291712749832 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/62e25985-ac19-41a5-8027-eb053f4a6490?source=cve · Nota