The WooCommerce PayPal Payments plugin for WordPress is vulnerable to sensitive information disclosure due to an insecure direct object reference in the enqueue_paypal_insights_script_on_order_received() function. This flaw arises from missing validation on a user‑controlled key, allowing an unauthenticated attacker to retrieve order keys and subsequently access full customer billing details—including name, email, phone, and address—through the WooCommerce Store API within a ten‑minute grace period after an order is created. The vulnerability therefore compromises the confidentiality of customer data by permitting attackers to exploit an authentication bypass to gather sensitive order information.

Affected systems include installations of the WooCommerce PayPal Payments plugin for WordPress with versions up to and including 3.3.2. Users of any WordPress site that has not upgraded past version 3.3.2 are potentially exposed, regardless of site configuration, as the flaw is present in all those releases.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can likely craft an HTTP request to the enqueue_paypal_insights_script_on_order_received() endpoint with a malicious key, bypassing authentication and triggering the data exposure. No additional preconditions such as administrative privileges are required, making this an unauthenticated information disclosure risk.