CVE-2025-14073: WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14073?
The severity of CVE-2025-14073 is rated as medium with a score of 5.3.
What does CVE-2025-14073 affect?
CVE-2025-14073 affects all versions of the WooCommerce PayPal Payments plugin for WordPress up to and including version 3.3.2.
How can CVE-2025-14073 be exploited?
CVE-2025-14073 can be exploited through an insecure direct object reference that leads to unauthenticated sensitive information disclosure.
How do I fix CVE-2025-14073?
To fix CVE-2025-14073, update the WooCommerce PayPal Payments plugin to version 3.4.0 or later.
What is the consequence of CVE-2025-14073?
The consequence of CVE-2025-14073 is the potential exposure of sensitive information to unauthorized users.