The Handily plugin contains a missing authorization check that allows any user, even those not logged in, to alter Stripe payment settings such as publishable keys, secret keys, and URL redirects. By changing these values an attacker can redirect customers’ payments to a Stripe account controlled by the attacker, resulting in loss of revenue and possible fraud. The vulnerability is a direct authorization flaw (CWE‑862). The plugin’s operational integrity is thus compromised.

The vulnerability is present in all released versions of the Handily WordPress plugin up to and including 1.0.3, distributed by the vendor Kamleshyadav. Only users of these versions are affected; newer releases are presumed fixed.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, but the lack of a public exploit and the absence from CISA KEV suggest the attack probability is low to moderate. An attacker would need to send a request that includes the payment settings parameters to a public WordPress site running Handily. Without authentication, the request will be processed because the plugin does not check user privileges, allowing the attacker to immediately overwrite Stripe credentials.