I've got a store where multiple countries have been removed from the countries table. If a customer uses the PayPal Express Shortcut button to pay for their order and their country is not present in the countries table, instead of disallowing the unsupported country the country is improperly changed to United States and the order is processed (with the incorrect address).

If, instead, I'd gone to the trouble of restoring all countries to the countries table and disabling those that are not supported by the store, all addresses would be allowed because the countries-table checks performed by the paypalwpp.php module don't include checking that the country is actually enabled.

I'm in the process of evaluating what changes are necessary to correct this issue and wanted to post the symptoms in case someone has already discovered and corrected the issue.