CVE-2026-6400 Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
Unauthenticated attackers can trick administrators into updating plugin settings via CSRF due to missing nonce verification in the Child Height Predictor plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-6400?
CVE-2026-6400 is a medium-severity vulnerability in helpstring Child Height Predictor by Ostheimer, published on 20 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().
Weakness: CWE-352
Which versions are affected by CVE-2026-6400?
How do I fix CVE-2026-6400?
No fix has been published for CVE-2026-6400 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6400 being exploited?
There is no known exploitation of CVE-2026-6400 in the wild and no public exploit code.
Sources
Also known as GHSA-5gxf-gf9p-vp7j.