CVE-2025-13842: Breadcrumb NavXT Authorization Bypass

CVE-2025-13842 Overview

The Breadcrumb NavXT plugin for WordPress is vulnerable to an authorization bypass through a user-controlled key in versions up to and including 7.5.0. This vulnerability exists due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without proper verification in the includes/blocks/build/breadcrumb-trail/render.php file. This flaw enables unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, potentially revealing post titles and hierarchy that should remain hidden from unauthorized users.

Critical Impact

Unauthenticated attackers can enumerate private and draft post content through breadcrumb trail information disclosure, compromising content confidentiality before publication.

Affected Products

• Breadcrumb NavXT plugin for WordPress versions up to and including 7.5.0
• WordPress installations using vulnerable Breadcrumb NavXT Gutenberg blocks
• Sites with draft or private posts utilizing breadcrumb navigation features

Discovery Timeline

• 2026-02-19 - CVE-2025-13842 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13842

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a category of access control weakness where security decisions rely on user-supplied input without proper validation. The Breadcrumb NavXT plugin fails to verify whether the requesting user has appropriate permissions to access the post content associated with the provided post_id parameter.

The vulnerable code path exists within the Gutenberg block rendering functionality. When the breadcrumb trail block processes a request, it accepts the post_id value directly from the $_REQUEST superglobal without checking the post's publication status or the user's authorization level. This architectural flaw allows any visitor—including unauthenticated users—to request breadcrumb data for posts they should not be able to access.

Root Cause

The root cause stems from improper access control implementation in the render.php file located at includes/blocks/build/breadcrumb-trail/. The code trusts user-supplied input for the post_id parameter without implementing authorization checks to verify whether the requested post is publicly accessible or whether the user has permission to view private or draft content. This missing validation layer allows direct object reference manipulation.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker can exploit this vulnerability by manipulating HTTP requests to the WordPress site, iterating through potential post_id values to discover and enumerate content that should be restricted.

The exploitation process involves sending crafted requests with various post_id values to trigger the breadcrumb trail rendering. When a valid draft or private post ID is supplied, the plugin returns breadcrumb information including the post title and its hierarchical position, effectively disclosing sensitive content metadata to unauthorized parties.

For technical implementation details, see the WordPress Breadcrumb Trail Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13842

Indicators of Compromise

• Unusual patterns of requests containing post_id parameters with sequential or random numeric values
• High volume of requests to pages utilizing Breadcrumb NavXT Gutenberg blocks from single IP addresses
• Access log entries showing requests for post IDs that correspond to unpublished content
• Requests attempting to access breadcrumb endpoints without associated page navigation patterns

Detection Strategies

• Monitor web server access logs for enumeration patterns targeting the breadcrumb trail functionality
• Implement rate limiting on requests containing post_id parameters to detect automated scanning
• Configure Web Application Firewall (WAF) rules to flag suspicious parameter manipulation attempts
• Review application logs for successful breadcrumb responses containing draft or private post data

Monitoring Recommendations

• Enable verbose logging for WordPress plugin activity, particularly for Breadcrumb NavXT
• Set up alerting for anomalous request patterns to Gutenberg block rendering endpoints
• Regularly audit access logs for potential information disclosure attempts
• Implement security monitoring solutions that can correlate multiple reconnaissance activities

How to Mitigate CVE-2025-13842

Immediate Actions Required

• Update Breadcrumb NavXT plugin to a version newer than 7.5.0 that includes the security patch
• Review WordPress content inventory to assess exposure of sensitive draft and private posts
• Temporarily disable the Breadcrumb NavXT Gutenberg block if immediate patching is not possible
• Audit access logs to determine if exploitation may have already occurred

Patch Information

The vulnerability has been addressed in WordPress Changeset #3425008. Site administrators should update to the patched version through the WordPress plugin update mechanism. The fix implements proper authorization checks before rendering breadcrumb trails for posts, ensuring that only publicly accessible content returns breadcrumb data to unauthenticated users.

Workarounds

• Disable the Breadcrumb NavXT Gutenberg block temporarily while awaiting patch deployment
• Implement WAF rules to validate and sanitize post_id parameters before they reach the application
• Restrict access to WordPress REST API endpoints if breadcrumb functionality is not required
• Consider using server-level access controls to limit requests to sensitive block rendering paths

# Configuration example - WAF rule to log suspicious post_id enumeration
# Apache mod_security rule
SecRule ARGS:post_id "@rx ^[0-9]+$" \
    "id:1001,\
    phase:2,\
    log,\
    msg:'Potential Breadcrumb NavXT enumeration attempt',\
    chain"
    SecRule &ARGS:post_id "@gt 5" \
        "deny,status:403"