EUVD-2025-210580
GHSA-p553-vwc7-337r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable, no authentication required; C:L reflects partial PII disclosure bounded by the 10-minute grace period window.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueue_paypal_insights_script_on_order_received() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.
AnalysisAI
Unauthenticated sensitive information disclosure in the WooCommerce PayPal Payments WordPress plugin (all versions through 3.3.2) allows remote attackers to harvest full customer billing PII from recently placed orders. The vulnerability is a two-stage IDOR chain: the enqueue_paypal_insights_script_on_order_received() function exposes order keys without validating the caller's identity, and those keys can then be replayed against the WooCommerce Store API - which grants a 10-minute post-order grace period - to retrieve names, email addresses, phone numbers, and street addresses. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-authentication attack path and PII sensitivity elevate practical risk above the CVSS 5.3 numeric score.
Technical ContextAI
The vulnerability resides in the Accelerated Checkout (AXO) module of the WooCommerce PayPal Payments plugin, specifically in modules/ppcp-axo/src/AxoModule.php at the enqueue_paypal_insights_script_on_order_received() function (visible at plugin tag 3.3.0, line 362). CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the function accepts a user-supplied order identifier without verifying that the requesting party owns or is authorized to view that order. This exposes the internal WooCommerce order key, a token the WooCommerce Store API treats as sufficient proof of order ownership during a 10-minute post-creation window - a legitimate grace period intended for order-confirmation pages. The IDOR therefore serves as a key-extraction primitive that unlocks a second, broader API endpoint to retrieve complete customer billing records. The affected CPE is the woocommerce-paypal-payments WordPress plugin, versions ≤ 3.3.2.
RemediationAI
Upgrade the WooCommerce PayPal Payments plugin to version 3.4.0 or later, which contains the fix committed in WordPress SVN changeset 3458079 modifying AxoModule.php to add proper authorization validation. The upgrade path is standard WordPress plugin update flow via the admin dashboard or WP-CLI (wp plugin update woocommerce-paypal-payments). If immediate upgrade is not possible, a targeted workaround is to disable the PayPal Accelerated Checkout (AXO) feature within the plugin settings, which removes the vulnerable code path; note this disables the streamlined checkout UX for returning PayPal users. Restricting access to the order-received confirmation endpoint at the WAF or server layer is not a reliable mitigation because the endpoint is required for legitimate post-purchase flows. The Wordfence advisory is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/a2919bbc-c4c2-4b52-90ec-2471218cd7d1 and the fix changeset is at https://plugins.trac.wordpress.org/changeset/3458079/woocommerce-paypal-payments/trunk/modules/ppcp-axo/src/AxoModule.php.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today