WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure

Vulnerability

The WooCommerce PayPal Payments plugin for WordPress versions up to and including 4.0.1 contains missing authorization checks on the ppc-create-order and ppc-get-order WC-AJAX endpoints. The ppc-create-order endpoint accepts an arbitrary WooCommerce order ID in the pay-now context without validating order ownership, allowing creation of PayPal orders for any WC order. The ppc-get-order endpoint returns full PayPal order details for any PayPal order ID without session binding. [1]

Exploitation

An unauthenticated attacker can chain these endpoints: first, call ppc-create-order with a victim's WooCommerce order ID to create a PayPal order and write PayPal metadata to that order. Then, call ppc-get-order with the resulting PayPal order ID to retrieve sensitive details such as payer information and shipping data. No authentication or user interaction is required. [1]

Impact

Successful exploitation allows an attacker to manipulate other customers' order payment flows by creating unauthorized PayPal orders, and to exfiltrate sensitive order details including payer information and shipping data. This leads to unauthorized order manipulation and information disclosure. [1]

Mitigation

The vulnerability is fixed in version 4.0.2 of the plugin. The latest version as of 2026-05-19 is 4.0.4. Users should update to version 4.0.2 or higher immediately. No workarounds are documented. [1]