Handily
Monthly
Remote unauthenticated attackers can redirect payments on WordPress sites using the Handily plugin (versions up to and including 1.0.3) by modifying Stripe payment settings because of missing authorization checks (CWE-862). They can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs to point to their own Stripe accounts. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 5.3 (Medium).
Remote unauthenticated attackers can redirect payments on WordPress sites using the Handily plugin (versions up to and including 1.0.3) by modifying Stripe payment settings because of missing authorization checks (CWE-862). They can change publishable keys, secret keys, email addresses, success URLs, and cancel URLs to point to their own Stripe accounts. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 score is 5.3 (Medium).