CVE Intelligence

Mtekk Breadcrumb NavXT vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Mtekk Breadcrumb NavXT: 1 record(s), with affected versions and fixes.

CVE-2025-13842 Medium · 5.3 CWE-639 Feb 19, 2026
Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.