EUVD-2026-103283
GHSA-x2rj-ccg3-p58p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site using Gantry 5 Framework
-
ExploitSend request triggering error condition
-
ExecutionRead sensitive data from error response
-
ImpactHarvest disclosed information for further attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The input does not name a specific feature, protocol, or configuration setting required - the description only states that error-message generation leaks embedded sensitive data (CWE-209) in Gantry 5 Framework versions up to and including 5.6.4. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is characterized as remotely reachable without authentication or user interaction against affected installations, but the advisory does not specify which request or error condition triggers disclosure. Limiting factors: the site must run a theme/configuration built on the Gantry 5 Framework at or below 5.6.4, and the practical value depends on what sensitive data the error actually embeds, which is unspecified; verify the trigger and exposed-data scope with Patchstack before assessing real impact. |
| Impact | This is a CWE-209 information-disclosure flaw in the Gantry 5 Framework (a WordPress theme framework) rated CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - network-reachable, low-complexity, no privileges or user interaction, high confidentiality impact only. No EPSS score, KEV listing, or POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; the only intelligence source is a single Patchstack advisory. The high CVSS is driven entirely by the C:H rating, but CWE-209 error-message disclosures frequently warrant only C:L in practice, and the description is abstract ('allows Retrieve Embedded Sensitive Data') without naming what data is exposed - so the real-world severity of the leaked information cannot be confirmed from available data and may be lower than the 7.5 suggests. With no evidence of active or automated exploitation, this reads as a genuine but non-emergency patch-cycle issue rather than an urgent priority. Note: the CVSS vector claims PR:N/UI:N unauthenticated remote access, yet the description gives no exploitation mechanism (which endpoint, what request, whether an error must be triggered) - verify the trigger path with Patchstack/vendor before assuming trivial unauthenticated access. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a request to a WordPress site running a theme built on the Gantry 5 Framework that induces an application error, and the resulting error message discloses embedded sensitive information (e.g., paths, configuration, or internal data). No public exploit code was identified, and the exact triggering request is not detailed in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 17, 2026
Error messages produced by the Gantry 5 Framework - a theme framework used by WordPress (and historically Joomla) sites - can embed sensitive data that unauthenticated remote users may retrieve, affecting all releases through 5.6.4. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the exposure is network-reachable at low complexity with no privileges or user interaction required, and the impact is high confidentiality loss only, with no integrity or availability effect. The Patchstack advisory does not specify which request or error condition triggers the disclosure, no public exploit code was identified at time of analysis, and the framework has not been added to CISA KEV; the practical severity therefore depends on what secrets the failing code path actually embeds. No public exploit identified at time of analysis.
RemediationAI
Upgrade the Gantry 5 Framework to a release later than 5.6.4 - that is the fixed boundary given in the advisory; the exact patched version number is not stated in the available data, so confirm the current release on the vendor/Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/gantry5/vulnerability/wordpress-gantry-5-framework-plugin-5-6-4-sensitive-data-exposure-vulnerability) before deploying. Because the fix version is not independently confirmed here, treat patch status as unconfirmed and apply compensating controls in the interim: set WP_DEBUG and WP_DEBUG_DISPLAY to false in wp-config.php and set PHP's display_errors to Off so exception output is never rendered to the browser (trade-off: developers lose on-screen diagnostics and must rely on log files); route errors to a log written outside the web root via error_log and block HTTP access to any log, .env, or config artifact left in the document root (trade-off: requires filesystem and web-server configuration changes and log rotation); and add a WAF or reverse-proxy rule that suppresses verbose error bodies from the affected theme endpoints and rate-limits requests that trigger abnormal responses (trade-off: generic responses can complicate legitimate troubleshooting and may produce false positives). Also review whether the exposed data includes credentials, API keys, or database details and rotate anything plausibly leaked, since CWE-209 disclosure cannot be undone by patching alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-209 (Generation of Error Message Containing Sensitive Information): application or framework code returns verbose diagnostic output - stack traces, absolute file paths, SQL fragments, configuration values, API keys or other embedded secrets - to the client instead of a generic message. In a PHP-based theme framework such as Gantry 5, this typically surfaces when error/debug display is enabled or when an exception handler echoes internal state before rendering a template; the CPE record cpe:2.3:a:gantry:gantry_5_framework:*:*:*:*:*:*:*:* confirms the whole product line up to and including 5.6.4 is treated as affected. Because the disclosure path is assessed as AV:N/AC:L/PR:N/UI:N, the flaw is characterized as reachable by an unauthenticated remote requester without any user interaction, but the advisory does not document the exact endpoint, parameter, malformed input, or error branch that produces the leak. The confidentiality-only scoring (C:H/I:N/A:N) reflects that data exfiltration is the sole demonstrated impact - there is no evidence in the available data of code execution, file write, or denial of service. The underlying technology is the Gantry 5 templating/configuration layer for WordPress themes, meaning exposure depends on the site actually running a Gantry 5-based theme at or below 5.6.4.
Know when Gantry 5 Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable error-message disclosure with no auth or interaction per the advisory; confidentiality-only impact, so I:N/A:N, and C retained at H consistent with vendor's sensitive-data claim.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.
Articles & Coverage 1
Executive ViewAI
Gantry 5 Framework through 5.6.4, a theme framework used by WordPress and historically Joomla sites, can disclose sensitive information to unauthenticated remote users through error messages. With no vendor patch available and no public exploit identified at time of analysis, the business risk depends on whether affected sites expose credentials, API keys, or other secrets that could enable downstream compromise; leadership should prioritize inventory and containment for internet-facing sites.
No vendor-released patch identified at time of analysis; interim mitigations include suppressing detailed error messages, restricting public exposure of affected Gantry 5 sites where feasible, deploying WAF/virtual-patching rules, monitoring logs for error-probing activity, inventorying all instances through 5.6.4, and rotating secrets that may have been exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB