{
 "id": "WPSEC-2026-1881",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1881/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1881/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1881/index.md",
 "title": "HandL UTM Grabber / Tracker <= 2.9.17 - Cross-Site Request Forgery to MCP Site Connection and Disconnection",
 "description": "The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Cross-Site Request Forgery via the MCP connection AJAX actions (handl_mcp_connect_site and handl_mcp_disconnect_site) in versions 2.9.14 up to, and including, 2.9.17, due to missing nonce validation in the ajaxConnectSite() and ajaxDisconnectSite() functions. This makes it possible for unauthenticated attackers to make the site connect to the remote UTM Grabber MCP reporting service under an email address they choose, which replaces and retires the existing connection credentials, or to disconnect the site from that service, granted they can trick a site administrator into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "handl-utm-grabber",
  "name": "HandL UTM Grabber / Tracker",
  "full_name": "HandL UTM Grabber / Tracker",
  "wordpress_org": "https://wordpress.org/plugins/handl-utm-grabber/",
  "advisories_url": "https://wpsec.com/vuln/plugin/handl-utm-grabber/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/handl-utm-grabber"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.9.14",
    "from_inclusive": true,
    "to": "2.9.18",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.9.14 before 2.9.18"
  ]
 },
 "introduced_in": "2.9.14",
 "fixed_in": "2.9.18",
 "remediation": "Update to 2.9.18 or later.",
 "fix_released": "2026-10-27T22:06:43+00:00",
 "published": "2026-10-28T22:44:49+00:00",
 "updated": "2026-10-28T09:11:28.895352+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1881/",
  "https://plugins.svn.wordpress.org/handl-utm-grabber/tags/2.9.18/",
  "https://wordpress.org/plugins/handl-utm-grabber/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/handl-utm-grabber",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}