The WooCommerce PayPal Payments plugin suffers from missing authorization on the `ppc-create-order` and `ppc-get-order` AJAX endpoints. The `ppc-create-order` endpoint accepts arbitrary WooCommerce order IDs in the 'pay-now' context without validating that the requester owns the order, allowing attackers to create PayPal orders and write metadata to victim orders. The `ppc-get-order` endpoint returns complete PayPal order details for any order ID without verifying the requester's session, enabling attackers to exfiltrate sensitive order data. These flaws combined permit unauthenticated attackers to manipulate other customers' payment processes and access confidential information.

An attacker can create PayPal orders associated with any WooCommerce order and retrieve full PayPal order details, including payer and shipping information, without authentication. This leads to unauthorized order manipulation and sensitive information disclosure. The vulnerability does not impact availability but compromises confidentiality and partially integrity of order data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints if possible and monitor for suspicious activity related to order creation and retrieval. Avoid exposing these endpoints publicly or implement custom authorization checks as a temporary measure.