CVE-2025-14073

Name of the Vulnerable Software and Affected Versions WooCommerce PayPal Payments versions prior to 3.3.3

Description An Insecure Direct Object Reference (IDOR) exists in the enqueue paypal insights script on order received() function due to missing validation on a user-controlled key. This allows unauthenticated attackers to obtain sensitive order information, such as order keys. These keys can be used to access full customer billing details, including name, email, phone, and address, via the WooCommerce Store API within a 10-minute grace period following the creation of an order.

Recommendations Update to a version newer than 3.3.2.