OK, so I did some further digging and found all the offending strings that cause the PayPal return to be blocked. Your options are to manually make a few edits to your .htaccess file, or to disable all WP Security modules that place these strings in your .htaccess file. Keep in mind if you choose to make the few modifications to your .htaccess file, you will likely need to make those same modifications whenever you update the plugin and/or whenever you make any changes to its settings.
If you choose to disabled modules instead, it looks like you would need to disable Bad Query Strings and Advanced Character String Filter (both under Additional Firewall Rules), as well as the Legacy 5G Firewall Protection (under 6G Blacklist Firewall Rules). I believe disabling these modules would lower your score by 30 points.
Here are the areas of my .htaccess file that needed to be modified:
In the #AIOWPS_DENY_BAD_QUERY_STRINGS_START section, find the line:
RewriteCond %{QUERY_STRING} (\;|'|\"|%22).*(request|insert|union|declare|drop) [NC]
and change it to:
RewriteCond %{QUERY_STRING} (\;|'|\").*(request|insert|union|declare|drop) [NC]
In the #AIOWPS_ADVANCED_CHAR_STRING_FILTER_START section, remove the following lines:
RedirectMatch 403 \%22
RedirectMatch 403 \%7B
RedirectMatch 403 \%7D
In the # 5G:[QUERY STRINGS] section, there are two lines that need to be modified.
Change:
RewriteCond %{QUERY_STRING} (\"|%22).*(<|>|%3) [NC,OR]
to:
RewriteCond %{QUERY_STRING} (\").*(<|>|%3) [NC,OR]
And change:
RewriteCond %{QUERY_STRING} (\;|'|\"|%22).*(union|select|insert|drop|update|md5|benchmark|or|and|if) [NC,OR]
to:
RewriteCond %{QUERY_STRING} (\;|'|\").*(union|select|insert|drop|update|md5|benchmark|or|and|if) [NC,OR]
I made these changes to my .htaccess file and my PayPal return was no longer blocked. For reference, under Basic Firewall Settings, I have everything enabled except Completely Block Access To XMLRPC (since I use Jetpack). Under Additional Firewall Rules and 6G Blacklist Firewall Rules I have everything enabled.
