CVE-2026-6400 Overview
CVE-2026-6400 is a Cross-Site Request Forgery (CSRF) vulnerability in the Child Height Predictor by Ostheimer plugin for WordPress. The flaw affects all versions up to and including 1.3. The plugin's options() function processes settings updates without performing nonce verification, leaving the administrative settings form unprotected against forged requests. Unauthenticated attackers can craft malicious pages that, when visited by an authenticated administrator, submit POST requests that modify plugin settings through update_option(). The vulnerability is tracked under CWE-352.
Critical Impact
Attackers can trick administrators into persisting unauthorized changes to plugin settings, including unit preferences, without their consent.
Affected Products
- Child Height Predictor by Ostheimer plugin for WordPress (all versions ≤ 1.3)
- WordPress sites with the vulnerable plugin installed and active
- Administrator accounts authenticated to the WordPress dashboard
Discovery Timeline
- 2026-05-20 - CVE-2026-6400 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-6400
Vulnerability Analysis
The vulnerability resides in the plugin's settings handler. The options() function processes form submissions for plugin configuration but omits the standard WordPress CSRF protections. Specifically, the form template does not emit a wp_nonce_field() call, and the server-side handler never invokes check_admin_referer() or wp_verify_nonce() before passing user-supplied data to update_option().
Because no anti-CSRF token is generated or validated, the application cannot distinguish between legitimate administrator-initiated requests and forged requests originating from a third-party site. The Exploit Prediction Scoring System (EPSS) currently rates this issue at 0.024%, reflecting limited active exploitation interest.
Root Cause
The root cause is missing nonce verification in the plugin settings workflow. WordPress provides wp_nonce_field() for embedding tokens into administrative forms and check_admin_referer() or wp_verify_nonce() for server-side validation. The plugin author omitted both controls in the settings page implementation, breaking the framework's CSRF defense model documented in the WordPress Plugin Source Code.
Attack Vector
An attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript-driven fetch() request targeting the vulnerable WordPress settings endpoint. The attacker lures an authenticated administrator to visit this page through phishing, a forum post, or a compromised website. The browser automatically attaches the administrator's session cookies to the cross-origin request, and the plugin processes the forged input as legitimate, persisting attacker-controlled values via update_option(). See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2026-6400
Indicators of Compromise
- Unexpected modifications to Child Height Predictor plugin options in the wp_options table without corresponding administrator activity in audit logs.
- POST requests to the plugin settings URL with Referer headers pointing to external or unrelated domains.
- Administrator browser sessions visiting unfamiliar URLs shortly before settings changes are observed.
Detection Strategies
- Monitor WordPress access logs for POST requests to the plugin's admin settings endpoint that lack expected nonce parameters (_wpnonce or _wp_http_referer).
- Correlate update_option() database writes with administrator session identifiers and source IP addresses to identify anomalies.
- Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST submissions to /wp-admin/ endpoints.
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture settings changes with user, timestamp, and request origin attribution.
- Alert on any change to plugin options outside of scheduled maintenance windows.
- Review browser proxy or endpoint telemetry on administrator workstations for visits to suspicious external domains preceding configuration changes.
How to Mitigate CVE-2026-6400
Immediate Actions Required
- Deactivate the Child Height Predictor by Ostheimer plugin until a patched release is available.
- Restrict administrative dashboard access using IP allowlists or VPN-only access to reduce CSRF exposure.
- Instruct administrators to log out of WordPress before browsing untrusted sites and to use separate browser profiles for administrative work.
Patch Information
No vendor patch has been published in the referenced advisory data at the time of NVD publication on 2026-05-20. Site operators should monitor the Wordfence Vulnerability Analysis and the plugin's WordPress.org page for updates beyond version 1.3.
Workarounds
- Remove the plugin entirely if it is not essential to site operations.
- Apply WAF rules that enforce same-origin checks on POST requests to /wp-admin/admin.php and related plugin endpoints.
- Implement browser-level defenses such as SameSite=Strict cookies for the WordPress session where compatibility allows.
# Example WAF rule pattern (ModSecurity) to block cross-origin POSTs to wp-admin
SecRule REQUEST_METHOD "@streq POST" \
"chain,id:1009000,phase:1,deny,status:403,msg:'Cross-origin POST to wp-admin blocked'"
SecRule REQUEST_URI "@contains /wp-admin/" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
