CVE-2025-14073

MEDIUM 5.3

WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.

CWE	CWE-639
Vendor	woocommerce
Product	woocommerce paypal payments
Published	Aug 1, 2026

Stay Ahead of the Next One

Get instant alerts for woocommerce woocommerce paypal payments

Be the first to know when new medium vulnerabilities affecting woocommerce woocommerce paypal payments are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

woocommerce / WooCommerce PayPal Payments

0 ≤ 3.3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a2919bbc-c4c2-4b52-90ec-2471218cd7d1?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.0/modules/ppcp-axo/src/AxoModule.php#L362 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-paypal-payments/tags/3.3.2&new_path=%2Fwoocommerce-paypal-payments/tags/3.4.0 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3458079/woocommerce-paypal-payments/trunk/modules/ppcp-axo/src/AxoModule.php

Credits

Drew Webber (mcdruid)