PT-2026-20607 · WordPress · Breadcrumb Navxt

Nosleep · Published 2026-02-19 · Updated 2026-02-19 · CVE-2025-13842

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Breadcrumb NavXT versions prior to 7.5.1

Description The Breadcrumb NavXT plugin for WordPress has an authorization bypass issue. This occurs because the Gutenberg block renderer trusts the post id parameter without proper verification within the includes/blocks/build/breadcrumb-trail/render.php file. An attacker can manipulate the post id parameter to enumerate and view breadcrumb trails for draft or private posts, potentially revealing post titles and hierarchy that should not be accessible. The vulnerable parameter is post id.

Recommendations Update Breadcrumb NavXT to version 7.5.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13842

Affected Products

Breadcrumb Navxt

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13842 · Security Note
• https://plugins.trac.wordpress.org/browser/breadcrumb-navxt/trunk/includes/blocks/build/breadcrumb-trail/render.php#L17 · Note
• https://plugins.trac.wordpress.org/changeset/3425008 · Note
• https://twitter.com/CVEnew/status/2024501291712749832 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/62e25985-ac19-41a5-8027-eb053f4a6490?source=cve · Note