CVE-2026-110889
7.5HighPublished 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-209
Impact
Unauthenticated remote attackers can view sensitive application data via exposed error messages. They only need network access to reach the vulnerable web endpoint.
Root cause
The framework includes sensitive internal details inside generated error messages.
Affected systems
Gantry 5 Framework (WordPress plugin) up to and including 5.6.4.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Gantry 5 Framework to a version newer than 5.6.4 once available. As an interim workaround, disable detailed error display in PHP and WordPress configuration (set WP_DEBUG_DISPLAY to false).
$ wp plugin update gantry5AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.