---
id: CVE-2025-14487
title: >-
  The Handily plugin for WordPress is vulnerable to unauthorized payment
  settings modification due to missing authorization checks in all versions up
  to, and including, 1.0.3
summary: >-
  The Handily plugin for WordPress is vulnerable to unauthorized payment
  settings modification due to missing authorization checks in all versions up
  to, and including, 1.0.3. This makes it possible for unauthenticated attackers
  to modify …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: kamleshyadav
product: Handily
affected:
  - Handily <= 1.0.3
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:04:55.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14487'
references:
  - url: 'https://codecanyon.net/item/handily-booking-system/34581545'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T10:08:37.103931Z'
ingestedAt: '2026-09-22T08:00:27.689Z'
epss: 0.0023
epssPercentile: 0.12237
---

## Overview

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.