# Tabby Checkout <= 5.16.1 - Unauthenticated Sensitive Information Exposure via Debug Log File

- **ID:** WPSEC-2026-2924
- **Plugin:** Tabby Checkout (`tabby-checkout`), https://wordpress.org/plugins/tabby-checkout/
- **Affected versions:** all versions before 5.16.2
- **Fixed in:** 5.16.2 (Update to 5.16.2 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-532
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tabby-checkout
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2924/

## Description

The Tabby Checkout plugin for WordPress is vulnerable to Sensitive Information Exposure via its debug log file in all versions up to, and including, 5.16.1. This is due to full API requests and responses being written to a predictable, publicly accessible file (log/tabby.log) inside the plugin directory when debug mode is enabled. This makes it possible for unauthenticated attackers to download the log and obtain order and customer personal data, payment details and API response data. Exploitation requires the debug setting to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2924/
- https://plugins.svn.wordpress.org/tabby-checkout/tags/5.16.2/
- https://wordpress.org/plugins/tabby-checkout/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2924/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.