CVE-2025-68035
Published: 22 January 2026
Summary
CVE-2025-68035 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct public-facing web plugin exposure (WordPress endpoint) allowing unauthenticated retrieval of sensitive data matches T1190 exploitation of public-facing applications.
NVD Description
Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.
Deeper analysisAI
CVE-2025-68035 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the tabbyai Tabby Checkout WordPress plugin, also referred to as tabby-checkout. This flaw affects all versions from n/a through 5.8.4 and enables attackers to retrieve embedded sensitive data. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting network accessibility, low attack complexity, no required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
Remote attackers can exploit this vulnerability without authentication or user interaction by accessing affected endpoints, allowing them to extract sensitive information embedded in transmitted data. Exploitation requires only network access to the vulnerable WordPress site running the plugin, potentially exposing confidential details such as user data or payment information depending on the context of the plugin's operation.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tabby-checkout/vulnerability/wordpress-tabby-checkout-plugin-5-8-4-sensitive-data-exposure-vulnerability?_s_id=cve provides details on this sensitive data exposure issue in Tabby Checkout version 5.8.4, including recommended mitigations such as updating to a patched version if available. Security practitioners should review the advisory for specific patch instructions and hardening guidance.
Details
- CWE(s)