CVE-2025-14487

MEDIUM 5.3

Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.

CWE	CWE-862
Vendor	kamleshyadav
Product	handily
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for kamleshyadav handily

Be the first to know when new medium vulnerabilities affecting kamleshyadav handily are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

kamleshyadav / Handily

0 ≤ 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve codecanyon.net: https://codecanyon.net/item/handily-booking-system/34581545

Credits

Phat RiO