The vulnerability is a missing authorization check on the ppc-create-order and ppc-get-order AJAX endpoints in the WooCommerce PayPal Payments plugin. Attackers can supply any WooCommerce order ID, causing a PayPal order to be created with arbitrary metadata and then retrieve full PayPal order details, exposing payer and shipping information. The flaw, classified as CWE-862, undermines both the integrity of order processing and the confidentiality of sensitive order data.

All installations of the WooCommerce PayPal Payments plugin that are version 4.0.1 or earlier are affected. This includes every site that runs WooCommerce with the PayPal Payments add‑on along with any WordPress installation in which the plugin is active. The vulnerability is present regardless of the WordPress user roles or site configuration.

The CVSS score of 8.2 indicates high severity. Although EPSS data is unavailable, the public nature of the AJAX endpoints means unauthenticated attackers can attempt exploitation at any time. The attacker simply crafts a HTTP request to the ppc-create-order endpoint with an order ID, then queries ppc-get-order to exfiltrate the associated PayPal transaction data. Because the plugin does not verify that the requester owns the order or is an authenticated administrator, the vulnerability can be leveraged to manipulate other customers’ orders and steal private information, making it a high‑risk threat for any e‑commerce site using the affected plugin.