HandL UTM Grabber / Tracker <= 2.9.17 - Cross-Site Request Forgery to MCP Site Connection and Disconnection
- ID
- WPSEC-2026-1881
- Plugin
- HandL UTM Grabber / Tracker (handl-utm-grabber)
- Affected
- from 2.9.14 before 2.9.18
- Remediation
- Update to 2.9.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- HandL UTM Grabber / Tracker on WPSec AttackSurface
- Fix released
- Published
Description
The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Cross-Site Request Forgery via the MCP connection AJAX actions (handl_mcp_connect_site and handl_mcp_disconnect_site) in versions 2.9.14 up to, and including, 2.9.17, due to missing nonce validation in the ajaxConnectSite() and ajaxDisconnectSite() functions. This makes it possible for unauthenticated attackers to make the site connect to the remote UTM Grabber MCP reporting service under an email address they choose, which replaces and retires the existing connection credentials, or to disconnect the site from that service, granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1881/
- https://plugins.svn.wordpress.org/handl-utm-grabber/tags/2.9.18/
- https://wordpress.org/plugins/handl-utm-grabber/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS