CVE-2025-14487 Overview
The Handily booking plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 1.0.3. Unauthenticated attackers can modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs. The flaw stems from absent capability checks on the payment settings endpoint [CWE-862]. Successful exploitation lets attackers redirect customer payments to attacker-controlled Stripe accounts, effectively hijacking revenue flows on affected sites.
Critical Impact
Unauthenticated attackers can rewrite Stripe payment keys and redirect e-commerce payments to attacker-owned accounts without any user interaction.
Affected Products
- Handily Booking System plugin for WordPress
- All versions through 1.0.3
- Distributed via CodeCanyon (item 34581545)
Discovery Timeline
- 2026-09-22 - CVE-2025-14487 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2025-14487
Vulnerability Analysis
The Handily plugin exposes a payment settings handler that accepts updates without verifying the caller's identity or capabilities. Any HTTP client can invoke the endpoint and overwrite critical Stripe integration parameters. Because the vulnerability targets configuration rather than execution, attackers can quietly change publishable and secret keys and swap the success and cancel URLs. Customers proceeding through checkout are then routed to a Stripe account controlled by the attacker, while the site operator continues to serve the booking flow. The issue is classified under Broken Access Control [CWE-862] and requires no authentication, no user interaction, and low attack complexity.
Root Cause
The payment settings update logic lacks both current_user_can() capability checks and a valid wp_nonce verification. Without these controls, the plugin treats any request that reaches the handler as authorized. The parameters accepting Stripe publishable keys, secret keys, notification email addresses, and redirect URLs are persisted directly to plugin options.
Attack Vector
Exploitation is performed over the network by sending a crafted HTTP request to the vulnerable settings endpoint. The attacker submits replacement Stripe credentials and redirect URLs. Subsequent bookings paid through the site's checkout flow are processed against the attacker's Stripe account. Detailed technical analysis is available in the Wordfence Vulnerability Report. No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-14487
Indicators of Compromise
- Unexpected changes to Stripe publishable or secret keys stored in the Handily plugin options table.
- Success or cancel URLs pointing to external domains not owned by the site operator.
- Notification email addresses in payment settings replaced with unfamiliar addresses.
- Customer complaints about payments not appearing in the merchant's Stripe dashboard.
Detection Strategies
- Audit the WordPress wp_options table for unauthorized modifications to Handily plugin configuration rows.
- Inspect web server access logs for unauthenticated POST requests targeting Handily payment settings endpoints.
- Compare current Stripe API keys in the plugin against a known-good baseline stored offline.
Monitoring Recommendations
- Enable file and database change auditing across all WordPress sites running the Handily plugin.
- Alert on outbound HTTP requests from checkout flows resolving to unexpected Stripe merchant identifiers.
- Correlate WordPress option changes with the originating IP address and authentication state.
How to Mitigate CVE-2025-14487
Immediate Actions Required
- Rotate all Stripe publishable and secret keys after verifying the current values in the plugin settings are legitimate.
- Restrict network access to /wp-admin/admin-ajax.php and Handily REST routes at the web application firewall layer until a patch is applied.
- Review recent Stripe transaction history for payments routed to unknown accounts.
Patch Information
At the time of NVD publication on 2026-09-22, no fixed version is listed. Version 1.0.3 and earlier remain vulnerable. Site operators should monitor the CodeCanyon Handily Booking System product page and the Wordfence Vulnerability Report for a vendor update.
Workarounds
- Deactivate and remove the Handily plugin until a patched release is available.
- Deploy a web application firewall rule that blocks unauthenticated requests to Handily payment settings actions.
- Restrict access to WordPress administration paths using IP allowlisting on the reverse proxy.
- Enable Stripe webhook verification and radar rules to alert on merchant configuration drift.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
