CVE-2025-14073 describes an authorization bypass vulnerability in the WooCommerce PayPal Payments plugin for WordPress versions up to and including 3.3.2. The flaw is an insecure direct object reference (CWE-639) caused by missing validation on a user-controlled key in the enqueue_paypal_insights_script_on_order_received() function. This allows unauthenticated attackers to retrieve sensitive order keys and subsequently access customer billing information such as name, email, phone, and address through the WooCommerce Store API during a 10-minute grace period after order creation.

An unauthenticated attacker can disclose sensitive customer order information including billing details by exploiting the insecure direct object reference vulnerability. This exposure is limited to a 10-minute window after order creation. The vulnerability does not impact integrity or availability but compromises confidentiality of customer data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider restricting access to the WooCommerce Store API or monitoring for suspicious activity related to order keys during the 10-minute grace period.