CVE-2025-14487: Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the Handily plugin in versions up to and including 1.0.3 are affected. The issue is remotely exploitable without authentication.
What can an attacker change?
An attacker can modify Stripe payment configuration values, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs. This may enable payments to be redirected to an attacker-controlled Stripe account.
How can I determine whether a site may have been targeted?
Review the plugin's Stripe payment settings for unexpected publishable or secret keys, email addresses, and altered success or cancel URLs. Compare the current values with known-good Stripe account and payment-flow configuration.