Junglewise Threat Intelligence

CVE-2026-6400: Ostheimer Child Height Predictor CSRF in options function

CVE-2026-6400 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Executive brief

The Child Height Predictor by Ostheimer plugin for WordPress is used to calculate and display estimated child growth on websites. A security flaw allows an attacker to trick a site administrator into unintentionally changing the plugin's settings, such as measurement unit preferences. This occurs if an administrator visits a malicious link while logged in, potentially leading to unauthorized configuration changes on the site.

Technical details

The Child Height Predictor by Ostheimer plugin for WordPress (up to version 1.3) contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce verification in the options() function. Specifically, the plugin's settings form lacks a wp_nonce_field() and the processing handler fails to implement check_admin_referer() or wp_verify_nonce(). An unauthenticated attacker can exploit this by inducing a logged-in administrator to submit a forged POST request, typically via a malicious website or link. Successful exploitation allows the attacker to modify plugin settings, such as unit preferences, which are then persisted to the database via the update_option() function.

Affected products

  • Ostheimer Child Height Predictor by Ostheimer up to and including 1.3

Timeline

  • 2026-05-20: advisory: NVD publication date

References