CVE-2025-68035
Published: 22 January 2026
Summary
CVE-2025-68035 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68035 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the tabbyai Tabby Checkout WordPress plugin, also referred to as tabby-checkout. This flaw affects all versions from n/a through 5.8.4 and enables attackers to retrieve embedded sensitive data. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting network accessibility, low attack complexity, no required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.
Remote attackers can exploit this vulnerability without authentication or user interaction by accessing affected endpoints, allowing them to extract sensitive information embedded in transmitted data. Exploitation requires only network access to the vulnerable WordPress site running the plugin, potentially exposing confidential details such as user data or payment information depending on the context of the plugin's operation.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tabby-checkout/vulnerability/wordpress-tabby-checkout-plugin-5-8-4-sensitive-data-exposure-vulnerability?_s_id=cve provides details on this sensitive data exposure issue in Tabby Checkout version 5.8.4, including recommended mitigations such as updating to a patched version if available. Security practitioners should review the advisory for specific patch instructions and hardening guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4009
Vulnerability details
Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct public-facing web plugin exposure (WordPress endpoint) allowing unauthenticated retrieval of sensitive data matches T1190 exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by identifying, reporting, and correcting the flaw in Tabby Checkout plugin versions through <=5.8.4 as recommended in the Patchstack advisory.
Filters sensitive information prior to release from affected plugin endpoints, preventing retrieval of embedded sensitive data by remote attackers.
Enforces approved authorizations on publicly accessible endpoints exploited without authentication, blocking unauthorized access to sensitive data transmitted by the plugin.