helpstring Child Height Predictor by Ostheimer Plugin up to 1.3 on WordPress options cross-site request forgery

Summaryinfo

A vulnerability classified as problematic was found in helpstring Child Height Predictor by Ostheimer Plugin up to 1.3 on WordPress. Affected is the function options. The manipulation results in cross-site request forgery. This vulnerability is known as CVE-2026-6400. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in helpstring Child Height Predictor by Ostheimer Plugin up to 1.3 on WordPress. Affected is the function options. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().

The weakness was published by Muhammad Nur Ibnu Hubab. The advisory is available at wordfence.com. This vulnerability is traded as CVE-2026-6400 since 04/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 1.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• helpstring

Name

• Child Height Predictor by Ostheimer Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion