CVE-2025-68035: Tabby Checkout Information Disclosure Flaw

CVE-2025-68035 Overview

CVE-2025-68035 is a Sensitive Data Exposure vulnerability in the Tabby Checkout WordPress plugin (tabby-checkout) developed by tabbyai. The vulnerability involves the insertion of sensitive information into sent data, which allows attackers to retrieve embedded sensitive data from the application. This flaw is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data).

Critical Impact

Sensitive customer or transaction data may be exposed to unauthorized parties through data transmitted by the Tabby Checkout plugin, potentially leading to privacy violations and compliance issues.

Affected Products

• Tabby Checkout WordPress Plugin versions up to and including 5.8.4
• WordPress installations using the tabby-checkout plugin

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-68035 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-68035

Vulnerability Analysis

This vulnerability falls under the category of Sensitive Data Exposure, specifically involving the improper handling of sensitive information during data transmission. The Tabby Checkout plugin fails to adequately protect or filter sensitive data before including it in outbound communications, resulting in potential exposure of confidential information.

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), which occurs when an application inserts sensitive information into data that is subsequently transmitted to external parties or systems without proper safeguards. In the context of a checkout plugin, this could include payment details, customer personal information, or transaction metadata.

Root Cause

The root cause of CVE-2025-68035 lies in improper data handling practices within the Tabby Checkout plugin. The application fails to properly sanitize or exclude sensitive information before sending data to external endpoints or including it in responses. This may occur during API communications, logging operations, or client-side data handling where sensitive fields are inadvertently exposed.

Attack Vector

An attacker can exploit this vulnerability by intercepting or analyzing data transmitted by the Tabby Checkout plugin. The attack may involve:

1. Monitoring network traffic between the WordPress site and external services
2. Analyzing client-side responses or API calls made by the plugin
3. Accessing logged or cached data that contains embedded sensitive information

The vulnerability does not require authentication to exploit if the sensitive data is exposed in client-facing responses. Technical details regarding the specific exploitation mechanism can be found in the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2025-68035

Indicators of Compromise

• Unexpected data appearing in browser developer tools network requests from the checkout process
• Sensitive information visible in server logs or client-side JavaScript console
• Reports of customer data exposure or privacy complaints
• Anomalous outbound traffic patterns from the WordPress server

Detection Strategies

• Monitor outbound HTTP/HTTPS traffic from WordPress installations for sensitive data patterns
• Implement Data Loss Prevention (DLP) rules to detect PII or payment information in transit
• Review plugin logs and WordPress debug logs for exposed sensitive fields
• Conduct regular security scans of the Tabby Checkout plugin configuration

Monitoring Recommendations

• Enable WordPress security logging to track plugin behavior during checkout transactions
• Configure web application firewalls to alert on sensitive data patterns in responses
• Implement endpoint monitoring on servers running vulnerable plugin versions
• Schedule periodic reviews of data transmitted during the checkout process

How to Mitigate CVE-2025-68035

Immediate Actions Required

• Update the Tabby Checkout plugin to a patched version when available from the vendor
• Review current plugin configuration for any settings that may increase data exposure
• Consider temporarily disabling the plugin until a security patch is released
• Audit recent transactions for potential data exposure incidents

Patch Information

Users should monitor the Patchstack Vulnerability Advisory for patch availability and update instructions. The affected versions include all releases through 5.8.4. Upgrading to a version beyond 5.8.4 that addresses this vulnerability is strongly recommended once available.

Workarounds

• Implement a web application firewall (WAF) to filter sensitive data from outbound responses
• Use HTTPS exclusively to encrypt data in transit and reduce interception risk
• Review and limit the data fields collected during the checkout process
• Consider alternative checkout plugins until an official patch is released
• Enable WordPress security hardening measures and restrict plugin permissions