A security researcher announced the discovery of an unpatched flaw in PayPal that could allow attackers to steal money from users.