CVE-2025-14073 Overview
CVE-2025-14073 is an Insecure Direct Object Reference (IDOR) vulnerability in the WooCommerce PayPal Payments plugin for WordPress. The flaw affects all versions up to and including 3.3.2. It resides in the enqueue_paypal_insights_script_on_order_received() function, which fails to validate a user-controlled key. Unauthenticated attackers can obtain order keys and use them to retrieve full customer billing information through the WooCommerce Store API within a 10-minute grace period after order creation. The vulnerability is tracked as CWE-639.
Critical Impact
Unauthenticated attackers can enumerate order keys and harvest customer names, emails, phone numbers, and billing addresses from affected WooCommerce stores.
Affected Products
- WooCommerce PayPal Payments plugin for WordPress
- All versions up to and including 3.3.2
- Fixed in version 3.4.0
Discovery Timeline
- 2026-08-01 - CVE-2025-14073 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2025-14073
Vulnerability Analysis
The vulnerability exists in the Axo (Accelerated Checkout) module of the WooCommerce PayPal Payments plugin. The enqueue_paypal_insights_script_on_order_received() function in modules/ppcp-axo/src/AxoModule.php accepts a user-supplied key parameter without verifying the requester's association with the referenced order. Because the function trusts the client-provided value, an attacker can substitute arbitrary values to reference orders they did not create.
Once an attacker obtains a valid order key, the WooCommerce Store API accepts that key as an authorization token for order-related lookups. The API returns the associated billing details, including the customer name, email address, phone number, and full address. Exposure is time-bounded to a 10-minute grace period following order creation, during which the order remains queryable through the Store API.
Root Cause
The root cause is missing authorization on a direct object reference. The plugin resolves order data based on a user-controlled key without confirming session ownership, nonce validity, or an authenticated relationship to the order. This pattern maps to CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
The attack is remote and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the vulnerable endpoint exposed by the plugin on any affected WooCommerce site. By iterating through candidate order identifiers or observing the order-received flow, the attacker retrieves order keys and then queries the WooCommerce Store API to extract personally identifiable information (PII). The vulnerable function reference and remediation changeset document the vulnerable code path and the applied fix.
No verified public exploit code is available. See the Wordfence Vulnerability Overview for additional technical detail.
Detection Methods for CVE-2025-14073
Indicators of Compromise
- Anomalous unauthenticated HTTP requests targeting the plugin's order-received endpoints shortly after order creation
- Repeated requests to the WooCommerce Store API referencing sequential or brute-forced order keys
- Unexpected outbound access to /wp-json/wc/store/ endpoints from unfamiliar IP addresses or user agents
- Elevated request volume against pages served by the ppcp-axo module
Detection Strategies
- Inspect web server access logs for enumeration patterns against WooCommerce Store API routes within short time windows
- Alert on unauthenticated requests that include key= parameters referencing orders from disparate customer sessions
- Deploy a Web Application Firewall (WAF) rule to flag high-frequency queries to /wp-json/wc/store/order/ endpoints
- Correlate spikes in order-received page requests with subsequent Store API activity from the same source
Monitoring Recommendations
- Log and retain WooCommerce Store API request metadata for at least 30 days for retrospective hunting
- Monitor the WordPress plugin inventory for installations of woocommerce-paypal-payments at versions 3.3.2 or earlier
- Baseline normal request rates to order confirmation pages and alert on statistical deviations
How to Mitigate CVE-2025-14073
Immediate Actions Required
- Upgrade the WooCommerce PayPal Payments plugin to version 3.4.0 or later on all WordPress sites
- Audit recent WooCommerce order traffic for signs of order key enumeration during the disclosure window
- Notify affected customers if log analysis confirms PII retrieval by unauthorized parties
- Rotate any exposed session tokens and confirm that no downstream systems trust the leaked billing data
Patch Information
The vendor fixed the vulnerability in version 3.4.0 of the WooCommerce PayPal Payments plugin. The patch adds validation on the user-controlled key in enqueue_paypal_insights_script_on_order_received(). Review the diff between 3.3.2 and 3.4.0 and the specific remediation changeset #3458079 for the code-level fix.
Workarounds
- Restrict access to /wp-json/wc/store/ endpoints at the WAF or reverse proxy layer where feasible
- Rate-limit unauthenticated requests to order confirmation and Store API routes to slow enumeration
- Temporarily disable the Axo (Accelerated Checkout) module if immediate patching is not possible
- Shorten the order-received grace period or invalidate order keys server-side once the customer session ends
# Update the plugin via WP-CLI to the fixed release
wp plugin update woocommerce-paypal-payments --version=3.4.0
# Verify the installed version
wp plugin get woocommerce-paypal-payments --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
