The vulnerability is caused by error messages that inadvertently expose embedded sensitive data. The flaw allows a potential attacker to retrieve confidential information such as credentials or configuration details, resulting in information disclosure. This weakness is classified as CWE‑209, which indicates that sensitive data is leaked through improper error handling.

The Gantry 5 Framework plugin for WordPress, including all versions up to and including 5.6.4, is affected by this issue.

The CVSS score of 7.5 indicates a moderate to high severity for this information disclosure. No EPSS score is available, so the current exploit probability cannot be quantified but is not necessarily low. The vulnerability is not listed in the CISA KEV catalog. Attackers who can trigger error conditions in the plugin—most likely through web requests that provoke errors—could potentially retrieve sensitive data. The description does not specify a required access level, so it is inferred that the attack vector is remote via the web interface of the WordPress site.