CVE-2025-14463 is a missing authorization vulnerability (CWE-862) in the Payment Button for PayPal WordPress plugin by naa986. The plugin exposes a public AJAX endpoint (`wppaypalcheckout_ajax_process_order`) that processes checkout results without authentication or server-side validation of PayPal transactions. Attackers can send crafted POST requests to this endpoint to create orders with arbitrary transaction IDs, payment statuses, product names, amounts, and customer information. If email notifications are enabled, the plugin will send purchase receipt emails to attacker-supplied addresses, resulting in unauthorized emails and potential order database corruption. The vulnerability affects all versions up to and including 1.2.3.41. No known exploits in the wild or patches are documented in the provided information.

Exploitation allows unauthenticated attackers to create arbitrary orders on affected sites, corrupting order data integrity and triggering unauthorized purchase receipt emails. This can lead to misinformation, potential reputational damage, and operational disruption. There is no direct confidentiality or availability impact indicated. The CVSS score of 5.3 reflects a medium severity impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling the plugin or restricting access to the AJAX endpoint if possible. Monitor for plugin updates from the vendor addressing this vulnerability. Avoid relying on the plugin for critical payment processing without verification of transaction authenticity.