CVE-2025-13842 is an authorization bypass vulnerability in the Breadcrumb NavXT plugin for WordPress, versions up to and including 7.5.0. The issue arises from the Gutenberg block renderer's reliance on the $_REQUEST['post_id'] parameter without verifying user authorization in includes/blocks/build/breadcrumb-trail/render.php. This flaw allows unauthenticated attackers to enumerate and access breadcrumb trails of draft or private posts by manipulating the post_id parameter, thereby exposing sensitive post metadata that should remain hidden.

The vulnerability allows unauthorized disclosure of breadcrumb trail information for draft or private posts. This exposure includes post titles and their hierarchical structure, which could reveal sensitive or confidential content metadata. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin or disabling it if possible to prevent unauthorized information disclosure. Monitor vendor channels for updates and apply patches promptly once released.