Unauthorized Payment Settings Modification in Handily Plugin for WordPress

CVE-2025-14487

What is CVE-2025-14487?

The Handily Booking System plugin for WordPress is susceptible to a serious flaw that enables unauthorized modification of payment settings. This vulnerability stems from the lack of proper authorization checks across all versions up to and including 1.0.3. Attackers can exploit this issue to gain access to critical Stripe configuration settings, such as publishable keys, secret keys, email addresses, success URLs, and cancel URLs. By manipulating these parameters, they can redirect payments to their own Stripe accounts, thereby compromising the integrity of financial transactions.

References