Handily exposes Stripe payment settings to anonymous modification
An unauthenticated attacker can change Stripe publishable/secret keys, payment email addresses and success/cancel URLs through payment-setting inputs without authorization. Replacing the payment configuration can divert subsequent payments to an attacker-controlled Stripe account. The endpoint and exact parameter names are unspecified; disclosure of the previous secret key is not established. Affected versions: <= 1.0.3. No fixed release is confirmed in this review.
- Component
- Handily
- Plugin slug
handily- Affected
- <= 1.0.3
- Safe version
- See mitigation notes
- Published
- Sep 22, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 22, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No confirmed fixed release. The vendor lists 1.0.4 with general capability, nonce and sanitization changes, but does not identify the Stripe settings path. It may resolve this issue, but is not confirmed here. Restrict payment-setting writes to authorized administrators, verify request intent and allowlist the fields accepted by the handler. Audit Stripe account and redirect settings and reconcile affected payments. Disable the affected payment path until a fix is confirmed. Official changelog: https://codecanyon.net/item/handily-booking-system/34581545
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N