CVE-2025-14073mediumCWE-639

CVE-2025-14073: medium-severity vulnerability in WooCommerce PayPal Payments

WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

Published · Updated

Follow this CVE+ Monitor WooCommerce PayPal Payments

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
woocommerce · WooCommerce PayPal Payments
Related CVEs — WooCommerce PayPal Payments

In the same product, most dangerous first.

CVE-2026-9284HIGHWooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information DisclosureEPSS 0.5%