What is CVE-2025-14487?

CVE-2025-14487 is a medium-severity vulnerability in Kamleshyadav Handily, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-09-22.

How severe is CVE-2025-14487?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Kamleshyadav Handily

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Kamleshyadav Handily

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-14487?: CVE-2025-14487 is a medium-severity vulnerability in Kamleshyadav Handily, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-09-22.
How severe is CVE-2025-14487?: Medium severity. CVSS v3 base score is 5.3 out of 10.