The WooCommerce PayPal Payments plugin suffers from missing authorization on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints. The `ppc-create-order` endpoint accepts arbitrary WooCommerce order IDs in the 'pay-now' context without validating if the requester owns the order, allowing attackers to create PayPal orders linked to other users' WooCommerce orders and write PayPal metadata. The `ppc-get-order` endpoint returns complete PayPal order details for any PayPal order ID without session binding, enabling unauthenticated attackers to retrieve sensitive payment and shipping information. These flaws combined allow attackers to manipulate other customers' payment processes and exfiltrate private data.

An attacker can perform unauthorized order manipulation by creating PayPal orders for any WooCommerce order and injecting PayPal metadata. Additionally, they can disclose sensitive PayPal order details, including payer and shipping information, without authentication. This compromises customer privacy and payment integrity, potentially leading to fraud or data leakage. The CVSS score of 8.2 reflects a high impact on confidentiality and a lower impact on integrity, with no impact on availability.

Patch status is not yet confirmed — no official fix or remediation level has been published by the vendor. Users should monitor the official WooCommerce and plugin vendor advisories for updates and apply patches promptly once available. Until a fix is released, consider disabling the WooCommerce PayPal Payments plugin or restricting access to the affected AJAX endpoints via web application firewall rules or other access controls to prevent unauthorized requests.