CVE-2025-13842: Mtekk Breadcrumb Navxt

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.

Affected products

• Mtekk Breadcrumb Navxt: up to and including 7.5.0

Published 2026-02-19. Last modified 2026-06-17.