CVE-2025-14073 is an authorization bypass vulnerability in the WooCommerce PayPal Payments plugin for WordPress. The issue stems from an insecure direct object reference caused by missing validation on a user-controlled key in the enqueue_paypal_insights_script_on_order_received() function. This flaw enables unauthenticated attackers to disclose sensitive information such as order keys and subsequently access customer billing details (name, email, phone, address) through the WooCommerce Store API within a limited time frame after order creation. The vulnerability affects all versions up to and including 3.3.2. No official patch or remediation level has been confirmed as of the published date.

An attacker can obtain sensitive order information without authentication, including order keys. Using these keys, the attacker can access full customer billing details via the WooCommerce Store API within a 10-minute grace period after order creation. This exposure risks customer privacy and could lead to further targeted attacks or fraud. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or official patch has been provided to date. Given the nature of the vulnerability, restricting access to the WooCommerce Store API and minimizing the exposure window may reduce risk, but these are not confirmed mitigations from the vendor.