A French software engineer who hunts for bugs in his spare time discovered the vulnerability. The issue stemmed from a cross-site request forgery (CSRF) vulnerability that existed in PayPal.me, a site the company launched last year to let its users request money. The worst someone could do is change the profile image of another user. The bug was reported to PayPal via HackerOne and received a $750 bounty from a French hacker who discovered the bug. PayPal was forced to patch a much nastier bug in its manager.com site earlier this year.
Source: https://threatpost.com/paypal-fixes-csrf-vulnerability-in-paypal-me/119435/