CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codecanyon.net/item/handily-booking-system/34581545
https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El plugin Handily para WordPress es vulnerable a la modificación no autorizada de la configuración de pagos debido a la falta de comprobaciones de autorización en todas las versiones hasta la 1.0.3, inclusive. Esto permite a atacantes no autenticados modificar la configuración de pagos de Stripe, incluyendo claves publicables, claves secretas, direcciones de correo electrónico, URL de éxito y URL de cancelación a través de los parámetros de configuración de pagos. Esto podría permitir a los atacantes redirigir los pagos a sus propias cuentas de Stripe.

22 Sep 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 08:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-14487

Mitre link : CVE-2025-14487

CVE.ORG link : CVE-2025-14487

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-14487", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14487", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T10:08:37.103931Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "kamleshyadav", "product": "Handily", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-22T08:16:35.987", "references": [{"url": "https://codecanyon.net/item/handily-booking-system/34581545", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts."}, {"lang": "es", "value": "El plugin Handily para WordPress es vulnerable a la modificaci\u00f3n no autorizada de la configuraci\u00f3n de pagos debido a la falta de comprobaciones de autorizaci\u00f3n en todas las versiones hasta la 1.0.3, inclusive. Esto permite a atacantes no autenticados modificar la configuraci\u00f3n de pagos de Stripe, incluyendo claves publicables, claves secretas, direcciones de correo electr\u00f3nico, URL de \u00e9xito y URL de cancelaci\u00f3n a trav\u00e9s de los par\u00e1metros de configuraci\u00f3n de pagos. Esto podr\u00eda permitir a los atacantes redirigir los pagos a sus propias cuentas de Stripe."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "security@wordfence.com"}