Gantry 5 Framework
Monthly
Error messages produced by the Gantry 5 Framework - a theme framework used by WordPress (and historically Joomla) sites - can embed sensitive data that unauthenticated remote users may retrieve, affecting all releases through 5.6.4. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the exposure is network-reachable at low complexity with no privileges or user interaction required, and the impact is high confidentiality loss only, with no integrity or availability effect. The Patchstack advisory does not specify which request or error condition triggers the disclosure, no public exploit code was identified at time of analysis, and the framework has not been added to CISA KEV; the practical severity therefore depends on what secrets the failing code path actually embeds. No public exploit identified at time of analysis.
Error messages produced by the Gantry 5 Framework - a theme framework used by WordPress (and historically Joomla) sites - can embed sensitive data that unauthenticated remote users may retrieve, affecting all releases through 5.6.4. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the exposure is network-reachable at low complexity with no privileges or user interaction required, and the impact is high confidentiality loss only, with no integrity or availability effect. The Patchstack advisory does not specify which request or error condition triggers the disclosure, no public exploit code was identified at time of analysis, and the framework has not been added to CISA KEV; the practical severity therefore depends on what secrets the failing code path actually embeds. No public exploit identified at time of analysis.