rootpwn

high · CVSS v3 7.5

CVE-2026-110889

Gantry 5 Framework up to version 5.6.4 can expose sensitive data through error messages. The flaw allows attackers to retrieve embedded conf

Overview

Gantry 5 Framework up to version 5.6.4 can expose sensitive data through error messages. The flaw allows attackers to retrieve embedded confidential information from the application. It affects all installations of Gantry 5 prior to 5.6.5.

Description

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.

Impact

The vulnerability compromises confidentiality by leaking sensitive data, potentially impacting integrity if attackers manipulate error handling. Defenders must protect against data exposure in logs and error pages. The risk is significant for exposed web applications.

Remediation

Apply the latest Gantry 5 Framework update (≥5.6.5). If updating is not immediately possible, disable detailed error messages in the configuration and ensure error pages do not reveal internal data. Monitor logs for anomalous error outputs.

Risk context

High severity with CVSS v3 score of 7.5. No EPSS data available, but the flaw remains relevant for all affected versions.

Affected products

  • Gantry 5 Framework

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

information-disclosure error-handling gantry web-framework high-severity patch defense

← All CVEs

Related CVEs

high

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.

View analysis

high

CVE-2026-104734

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.

View analysis

high

CVE-2026-103899

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.

View analysis

high

CVE-2026-108123

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.

View analysis