CVE-2025-68035: 
WordPress vulnerability analysis and mitigation

CVE-2025-68035 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the Tabby Checkout WordPress plugin developed by tabbyai. The vulnerability allows unauthenticated remote attackers to retrieve embedded sensitive data from affected installations. It impacts all versions of the Tabby Checkout plugin up to and including version 5.8.4. The CVE was published on January 22, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) by CISA-ADP (Patchstack, NVD).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data — such as API keys, credentials, or configuration secrets — within data transmitted to clients or external parties. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker who can send HTTP requests to a WordPress site running the affected plugin. The specific mechanism by which sensitive data is embedded in sent data (e.g., in HTTP responses, JavaScript output, or API calls) has not been fully detailed in public write-ups, as the Patchstack advisory page content was not publicly accessible at the time of this report (NVD, Patchstack).

Successful exploitation results in a high confidentiality impact, with no integrity or availability impact. An unauthenticated attacker can retrieve sensitive embedded data — potentially including payment gateway API keys, merchant credentials, or other secrets used by the Tabby Checkout plugin — which could be leveraged for financial fraud, unauthorized transactions, or further attacks against the merchant's payment infrastructure. The scope is limited to the affected WordPress installation, but exposure of payment-related credentials could have significant downstream consequences for merchants and their customers (NVD, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-68035 at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (NVD).

WordPress site administrators running the Tabby Checkout plugin should update to a version beyond 5.8.4 immediately, as all versions up to and including 5.8.4 are affected. If a patched version is not yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, administrators should rotate any API keys, merchant credentials, or secrets configured within the plugin, as these may have been exposed to unauthorized parties (Patchstack, NVD).

The vulnerability was discovered and reported by Patchstack, a WordPress security platform, and was assigned by them as the CVE Numbering Authority (CNA). No notable public commentary from security researchers or significant media coverage has been identified beyond the initial Patchstack disclosure (NVD).