# Gantry 5 Framework <= 5.6.4 - Unauthenticated Sensitive Information Exposure via Detailed Debug Error Page

- **ID:** WPSEC-2026-1295
- **Plugin:** Gantry 5 Framework (`gantry5`), https://wordpress.org/plugins/gantry5/
- **Affected versions:** all versions before 5.6.5
- **Fixed in:** 5.6.5 (Update to 5.6.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-209
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gantry5
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1295/

## Description

The Gantry 5 Framework plugin for WordPress is vulnerable to Sensitive Information Exposure via the detailed (Whoops) debug error page in all versions up to, and including, 5.6.4. The plugin registers the detailed error handler for every visitor whenever the theme's production flag is unset, debug mode is on, or is_admin() is true, and is_admin() is also true for anonymous admin-ajax.php requests. In addition, the unauthenticated particle AJAX handler does not validate the requested outline and does not catch the errors that follow. This makes it possible for unauthenticated attackers to trigger an error, for example with a particle AJAX request naming a non-existent outline, and view full stack traces, absolute file paths, and server, environment, cookie, session and POST data that may contain secrets.

## References

- https://wpsec.com/vuln/WPSEC-2026-1295/
- https://plugins.svn.wordpress.org/gantry5/tags/5.6.5/
- https://wordpress.org/plugins/gantry5/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1295/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.