{
 "id": "WPSEC-2026-2924",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2924/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2924/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2924/index.md",
 "title": "Tabby Checkout <= 5.16.1 - Unauthenticated Sensitive Information Exposure via Debug Log File",
 "description": "The Tabby Checkout plugin for WordPress is vulnerable to Sensitive Information Exposure via its debug log file in all versions up to, and including, 5.16.1. This is due to full API requests and responses being written to a predictable, publicly accessible file (log/tabby.log) inside the plugin directory when debug mode is enabled. This makes it possible for unauthenticated attackers to download the log and obtain order and customer personal data, payment details and API response data. Exploitation requires the debug setting to be enabled.",
 "plugin": {
  "slug": "tabby-checkout",
  "name": "Tabby Checkout",
  "full_name": "Tabby Checkout",
  "wordpress_org": "https://wordpress.org/plugins/tabby-checkout/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tabby-checkout/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tabby-checkout"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.16.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.16.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.16.2",
 "remediation": "Update to 5.16.2 or later.",
 "fix_released": "2026-11-11T14:00:08+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:10:10.963946+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2924/",
  "https://plugins.svn.wordpress.org/tabby-checkout/tags/5.16.2/",
  "https://wordpress.org/plugins/tabby-checkout/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tabby-checkout",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}