CVE-2025-13842: 
WordPress vulnerability analysis and mitigation

CVE-2025-13842 is an authorization bypass vulnerability (CWE-639) in the Breadcrumb NavXT plugin for WordPress, affecting versions up to and including 7.5.0. The flaw allows unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, exposing post titles and hierarchy that should remain hidden. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is an authorization bypass through a user-controlled key (CWE-639) in the file includes/blocks/build/breadcrumb-trail/render.php. The Gutenberg block renderer trusts the $_REQUEST['post_id'] parameter without any authentication or authorization verification, allowing any unauthenticated user to supply an arbitrary post ID. By iterating over post IDs, an attacker can retrieve breadcrumb trail data — including titles and hierarchical structure — for posts in draft or private status that are not intended to be publicly accessible (Red Hat CVE).

Successful exploitation results in unauthorized disclosure of confidential post metadata (titles and hierarchy) for draft or private WordPress posts, representing a low confidentiality impact with no effect on integrity or availability. While the vulnerability does not enable code execution or account takeover, it can expose sensitive editorial content, unreleased announcements, or internal site structure to unauthenticated external parties. The scope is limited to the affected WordPress installation and does not facilitate lateral movement (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13842. The EPSS score is approximately 0.035%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only network access and no authentication, making it trivially easy to attempt, though the impact is limited to information disclosure (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Breadcrumb NavXT plugin version 7.5.0 or earlier using tools like WPScan or by checking the plugin version in publicly accessible readme files.
2. Identify a Gutenberg block endpoint: Locate a page or post on the target site that renders a Breadcrumb NavXT Gutenberg block, which triggers the vulnerable render.php code path.
3. Craft a malicious request: Send an HTTP GET or POST request to the WordPress site with a manipulated post_id parameter targeting a known or guessed post ID (e.g., /?post_id=42).
4. Enumerate private/draft posts: Iterate over a range of post IDs and observe the breadcrumb trail output in the response; posts that return breadcrumb data with titles reveal the existence and title of otherwise hidden draft or private content.
5. Collect disclosed information: Record exposed post titles and hierarchical structure for reconnaissance or further targeted attacks (Red Hat CVE).

• Network: Unusual HTTP requests to WordPress pages containing a post_id parameter with sequential or random integer values, particularly from a single IP or user agent in rapid succession.
• Logs: WordPress or web server access logs showing repeated requests with varying post_id values (e.g., GET /?post_id=1, GET /?post_id=2, etc.) from the same source IP, especially targeting pages with Breadcrumb NavXT blocks.
• Logs: Requests returning breadcrumb data for posts not linked from any public page, indicating enumeration of non-public content.

WordPress site administrators should update the Breadcrumb NavXT plugin to a version beyond 7.5.0 that addresses this authorization bypass. As a temporary workaround, administrators can disable the Gutenberg block functionality of the plugin or restrict access to the affected render endpoint via web application firewall (WAF) rules that block requests containing unexpected post_id parameters. Monitoring access logs for enumeration patterns is also recommended until a patch is applied (Red Hat CVE, Sucuri Blog).

The vulnerability was noted in Sucuri's February 2026 vulnerability patch roundup, indicating it received routine coverage among WordPress security monitoring services (Sucuri Blog). No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond standard vulnerability database entries.