CVE-2025-14073

mediumCVSS 5.3covered by 1 sourcefirst seen 2026-08-01

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueue_paypal_insights_script_on_order_received() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.

⚡ Watch CVE-2025-14073

Get an email if CVE-2025-14073 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2025-14073: The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Di…nvd · 2026-08-01

External references

NVD record for CVE-2025-14073

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2025-14073 status](https://www.csirts.com/badge/CVE-2025-14073)](https://www.csirts.com/cve/CVE-2025-14073)