What the vulnerability does
01Description
The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().
Explanation of Vulnerability in Simple Terms
02Summary
The Child Height Predictor by Ostheimer plugin versions 1.3 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within the plugin without the admin's knowledge or consent. The vulnerability requires user interaction and does not expose sensitive data.
What an attacker can do
03Attacker Capabilities
Trick a site admin into performing unwanted actions in the plugin by visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify plugin settings or data if an admin visits a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
May 20, 2026
CVE published
May 20, 2026
Record updated
