The Breadcrumb NavXT plugin for WordPress is vulnerable to an authorization bypass that occurs when the plugin’s Gutenberg block renderer trusts the user‑controlled $_REQUEST['post_id'] parameter without verification. This flaw allows an unauthenticated attacker to query the breadcrumb trail endpoint and retrieve the titles and hierarchical positions of draft or private posts. The exposed information is post titles and parent relationships, which are intended to remain confidential to authorized editors or administrators, representing a direct breach of confidentiality.

The vulnerability affects the Breadcrumb NavXT plugin from the vendor mtekk. Versions up to and including 7.5.0 are impacted. WordPress sites that have installed or are still using any version of Breadcrumb NavXT 7.5.0 or lower are at risk; newer releases are not affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker need only supply a crafted post_id value in a request to the block renderer; no authentication is required and no privileged environment is needed. Once the mis‑handled parameter is used, the attacker can enumerate private or draft post keys and view their breadcrumb trails, thus obtaining sensitive post metadata.