CVE-2025-68035

Executive Summary

CVE-2025-68035 is a high-severity (CVSS 7.5) information disclosure vulnerability affecting the Tabby Checkout WordPress plugin by Tabbyai, up to and including version 5.8.4. The vulnerability is classified as an "Insertion of Sensitive Information Into Sent Data" (CWE-201), allowing an unauthenticated remote attacker to retrieve embedded sensitive data from the plugin's responses. This can lead to the exposure of API keys, tokens, or other secrets that are inadvertently included in client-side data transmissions.

Given that this is a WordPress plugin vulnerability, the attack surface is broad, as many e-commerce sites rely on Tabby Checkout for payment processing. The lack of a confirmed patch and the absence of public exploit code or proof-of-concept (POC) at this time means defenders must rely on detection and mitigation strategies.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository or via direct upload are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Administrators should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Sensitive data is exposed.
• Integrity Impact: None (I:N) – Data integrity is not affected.
• Availability Impact: None (A:N) – Service availability is not impacted.

Threat Level: High. The low attack complexity and lack of required privileges make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the tabby-checkout plugin's handling of sensitive data during checkout processes. The plugin likely embeds API keys, merchant tokens, or other secrets directly into JavaScript or HTML responses sent to the client. An attacker can intercept these responses (e.g., via network sniffing, browser developer tools, or by inspecting HTTP responses) to extract the embedded sensitive information.

Root Cause: The plugin fails to properly sanitize or separate sensitive data from client-facing output. Instead of storing secrets server-side and using nonces or short-lived tokens, the plugin includes them in the response body, making them accessible to anyone who can view the page source or network traffic.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with specific parameters) that triggers the plugin to return sensitive data in the response. Alternatively, simply loading a checkout page may expose the data.

Impact: Successful exploitation allows an attacker to retrieve sensitive information such as:

• API keys for payment gateways
• Merchant authentication tokens
• Database credentials (if improperly stored)
• Other secrets that could lead to further compromise

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (tabby-checkout <= 5.8.4):

// Example of vulnerable code that embeds sensitive data in a response
function tabby_checkout_get_config() {
    $config = array(
        'api_key' => get_option('tabby_api_key'), // Sensitive data
        'merchant_id' => get_option('tabby_merchant_id'),
        'public_token' => get_option('tabby_public_token')
    );
    wp_send_json($config); // Sends sensitive data to client
}

Patched Code (Hypothetical):

// Patched version that uses server-side processing and nonces
function tabby_checkout_get_config() {
    $nonce = wp_create_nonce('tabby_checkout_nonce');
    $config = array(
        'nonce' => $nonce,
        'public_token' => get_option('tabby_public_token') // Only non-sensitive data
    );
    wp_send_json($config);
}

The patched version would remove sensitive fields from client-facing responses and use nonces or short-lived tokens for server-side validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Tabby Checkout plugin version <= 5.8.4 installed and activated.
• Network access to the target site.

Exploitation Steps:

1. Identify the vulnerable endpoint: The plugin likely exposes an AJAX action (e.g., tabby_checkout_get_config) that returns sensitive data.
2. Craft a request: Send a GET or POST request to the endpoint without authentication.
3. Extract sensitive data: Parse the JSON response to retrieve API keys or tokens.

Example Request (using curl):

curl -X POST "https://target-site.com/wp-admin/admin-ajax.php" \
  -d "action=tabby_checkout_get_config"

Expected Response (vulnerable):

{
  "api_key": "sk_live_xxxxxxxxxxxxx",
  "merchant_id": "merchant_12345",
  "public_token": "tok_xxxxxxxxxxxxx"
}

Automation: Use a script to scan multiple sites for the vulnerable endpoint and extract data.

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP responses for patterns matching API keys or tokens (e.g., sk_live_, pk_live_, tok_).
• Use WAF rules to block requests to known vulnerable AJAX actions.
• Implement logging for all AJAX requests and responses.

Mitigation:

• Disable or remove the vulnerable plugin until a patch is available.
• If removal is not possible, restrict access to the AJAX endpoint via .htaccess or server configuration.
• Use a Web Application Firewall (WAF) to block requests containing sensitive data patterns in responses.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=tabby_checkout_get_config or similar.
• Responses containing patterns like "api_key", "merchant_id", "public_token", or base64-encoded secrets.

File IOCs:

• Presence of the tabby-checkout plugin directory in /wp-content/plugins/.
• Modified plugin files that may indicate exploitation attempts.

Log IOCs:

• Unusual AJAX requests from unauthenticated users.
• Repeated requests to the same endpoint from a single IP.

Detection Engineering

YARA Rule

rule CVE_2025_68035_Tabby_Checkout_Info_Leak {
    meta:
        description = "Detects sensitive data leakage from Tabby Checkout plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68035"
    strings:
        $api_key = /"api_key"\s*:\s*"[A-Za-z0-9_]+"/
        $merchant_id = /"merchant_id"\s*:\s*"[A-Za-z0-9_]+"/
        $public_token = /"public_token"\s*:\s*"[A-Za-z0-9_]+"/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-68035 - Tabby Checkout Sensitive Data Leak
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing sensitive data from Tabby Checkout plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 'action=tabby_checkout_get_config'
        sc-status: 200
    keywords:
        - 'api_key'
        - 'merchant_id'
        - 'public_token'
    condition: selection and keywords
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68035 - Tabby Checkout Sensitive Data Leak"; flow:to_server,established; content:"action=tabby_checkout_get_config"; http_client_body; nocase; content:"api_key"; http_server_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and remove the Tabby Checkout plugin from all WordPress installations until a patch is released.
2. Rotate secrets: If the plugin was active, immediately rotate any API keys, tokens, or credentials that may have been exposed.
3. Review logs: Check web server and application logs for signs of exploitation (e.g., requests to the vulnerable endpoint).

Long-term Mitigation:

• Monitor the vendor's website for a patched version (>= 5.8.5).
• Implement a Web Application Firewall (WAF) with rules to block requests to known vulnerable endpoints.
• Conduct a security audit of all WordPress plugins to ensure no other sensitive data leakage vulnerabilities exist.
• Follow the principle of least privilege: never embed sensitive data in client-side code.

Workaround (if plugin cannot be removed):

• Use .htaccess to restrict access to the AJAX endpoint:

<Files "admin-ajax.php">
    Require all denied
</Files>

• Alternatively, use a plugin like "Disable AJAX" to block unauthenticated AJAX requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert