Vulnerabilities / Tabby Checkout / WPSEC-2026-2924
Tabby Checkout <= 5.16.1 - Unauthenticated Sensitive Information Exposure via Debug Log File
Medium 5.9
CWE-532Fixed in 5.16.2
- ID
- WPSEC-2026-2924
- Plugin
- Tabby Checkout (tabby-checkout)
- Affected
- all versions before 5.16.2
- Remediation
- Update to 5.16.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Tabby Checkout on WPSec AttackSurface
- Fix released
- Published
Description
The Tabby Checkout plugin for WordPress is vulnerable to Sensitive Information Exposure via its debug log file in all versions up to, and including, 5.16.1. This is due to full API requests and responses being written to a predictable, publicly accessible file (log/tabby.log) inside the plugin directory when debug mode is enabled. This makes it possible for unauthenticated attackers to download the log and obtain order and customer personal data, payment details and API response data. Exploitation requires the debug setting to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2924/
- https://plugins.svn.wordpress.org/tabby-checkout/tags/5.16.2/
- https://wordpress.org/plugins/tabby-checkout/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS