EUVD-2025-210984
GHSA-rqq6-mm6q-4qqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Handily <=1.0.3
-
DeliverySend unauthenticated request to payment settings endpoint
-
ExploitMissing authorization check accepts request
-
ExecutionOverwrite Stripe keys and success/cancel URLs
-
ImpactCustomer payments redirected to attacker Stripe account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Handily WordPress plugin (versions <=1.0.3). The only meaningful precondition is that the target site actually runs Handily and uses its Stripe payment/booking feature, so that overwriting the payment configuration has monetary effect; the payment-settings modification endpoint itself requires no authentication, no user interaction, and no non-default setup. Realistic impact is limited to sites where bookings/payments are live. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium) and CWE-862 are internally consistent: a remote, unauthenticated, low-complexity request modifies configuration with limited integrity impact and no confidentiality or availability impact. This is a genuine, easily-reachable flaw - no authentication, no user interaction, no special preconditions on default installs - which raises its practical exploitability above what the 5.3 numeric score suggests. However, EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is identified, so there is no evidence of active or automated exploitation. The I:L (rather than I:H) rating understates business risk: redirecting a merchant's Stripe payment flow to an attacker's account is a direct financial-theft primitive, even though it does not alter core WordPress system integrity - this is a case where the CVSS 'technical integrity' metric diverges from real-world monetary impact. Net: a real, low-effort issue worth prompt patching for any site actually running Handily's payment features, but not a mass-exploitation emergency based on current signals. Missing data (EPSS, fixed version, patch changeset) should be verified with Wordfence/vendor. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the Handily plugin's payment-settings handler, which lacks any authorization check, and overwrites the site's Stripe publishable key, secret key, and success/cancel URLs with attacker-controlled values. Subsequent customer bookings then route payment through the attacker's Stripe account, silently redirecting revenue. No public exploit code is identified at time of analysis, but the network-reachable, no-auth, low-complexity nature makes reproduction trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Remote unauthenticated attackers can redirect payments on WordPress sites using the Handily plugin (versions up to and including 1.0.3) by modifying Stripe payment settings because of missing authorization checks (CWE-862). They can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs to point to their own Stripe accounts. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 5.3 (Medium).
RemediationAI
No vendor-released patch has been identified at time of analysis. Because the flaw allows unauthenticated modification of Stripe settings, the most direct mitigation is to disable the Handily plugin until a fix is available; this eliminates risk but removes booking/payment functionality. If the plugin must remain active, restrict access to its payment settings endpoints-e.g., deploy a web application firewall rule to block unauthenticated POST requests to the Handily payment settings handler (likely admin-ajax.php with a specific action or a REST route), while being aware that WAF bypasses are possible and the rule may need tuning. Additionally, monitor the Stripe dashboard for unexpected changes to API keys, email addresses, or redirect URLs, and consider temporarily removing Stripe secret keys from the plugin configuration if payments are not actively processed. Check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve) and the vendor's CodeCanyon page for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Handily plugin (CPE: cpe:2.3:a:kamleshyadav:handily) is a WordPress booking system that integrates with Stripe for payments. The vulnerability stems from CWE-862 (Missing Authorization): the plugin's payment settings update functionality does not perform capability or nonce checks, allowing unauthenticated requests to alter configuration values. Specifically, the payment settings parameters-publishable key, secret key, email address, success URL, and cancel URL-can be overwritten via a direct request. This class of flaw is common in WordPress plugins that register AJAX actions or REST routes without proper permission callbacks, enabling attackers to invoke privileged functionality without logging in. The affected versions are all releases up to and including 1.0.3, as indicated by the CPE wildcard for version.
Know when Handily gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network request (PR:N/AV:N/AC:L/UI:N) modifies config for limited integrity impact (I:L); no confidentiality or availability effect; scope unchanged.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB