CVE-2025-14073

MediumCVSS 5.3

Published: 01/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to sensitive information disclosure due to an insecure direct object reference (IDOR) in all versions up to and including 3.3.2 via the enqueue_paypal_insights_script_on_order_received() function due to missing validation on a user-controlled key.

Risk Assessment

Unauthenticated attackers can obtain sensitive order information including order keys, then access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation. This could lead to identity theft or fraud.

Recommendation

Immediately update the WooCommerce PayPal Payments plugin to the latest version that fixes this vulnerability. Also consider restricting Store API access for unauthenticated users.

Other vulnerabilities in WooCommerce PayPal Payments

CVE-2026-9284High
The WooCommerce PayPal Payments plugin for WordPress up to version 4.0.1 allows unauthenticated attackers to manipulate orders and leak information due to missing authorization on AJAX endpoints ppc-create-order and ppc-get-order. Attackers can create PayPal orders for any WC order and read other users' PayPal order details.

Original NVD description (English source)

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.