# HandL UTM Grabber / Tracker <= 2.9.17 - Cross-Site Request Forgery to MCP Site Connection and Disconnection

- **ID:** WPSEC-2026-1881
- **Plugin:** HandL UTM Grabber / Tracker (`handl-utm-grabber`), https://wordpress.org/plugins/handl-utm-grabber/
- **Affected versions:** from 2.9.14 before 2.9.18
- **Fixed in:** 2.9.18 (Update to 2.9.18 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/handl-utm-grabber
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1881/

## Description

The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Cross-Site Request Forgery via the MCP connection AJAX actions (handl_mcp_connect_site and handl_mcp_disconnect_site) in versions 2.9.14 up to, and including, 2.9.17, due to missing nonce validation in the ajaxConnectSite() and ajaxDisconnectSite() functions. This makes it possible for unauthenticated attackers to make the site connect to the remote UTM Grabber MCP reporting service under an email address they choose, which replaces and retires the existing connection credentials, or to disconnect the site from that service, granted they can trick a site administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1881/
- https://plugins.svn.wordpress.org/handl-utm-grabber/tags/2.9.18/
- https://wordpress.org/plugins/handl-utm-grabber/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1881/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.