CVE-2026-6400 describes a CSRF vulnerability in the Child Height Predictor by Ostheimer WordPress plugin affecting all versions up to 1.3. The issue stems from the options() function handling plugin settings updates without nonce verification. The form template does not include wp_nonce_field(), and the handler does not call check_admin_referer() or wp_verify_nonce(), which are standard WordPress protections against CSRF. Consequently, an unauthenticated attacker can craft a malicious link or page that causes an administrator to unknowingly submit a forged POST request, leading to unauthorized changes in plugin settings such as unit preferences stored via update_option().

The vulnerability allows unauthorized modification of plugin settings by exploiting the lack of CSRF protections. While it does not disclose sensitive data or allow code execution, it can cause integrity issues by changing configuration values without administrator consent. The CVSS score of 4.3 reflects a medium severity impact with low complexity and no required privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress admin or consider disabling the plugin. Applying standard WordPress security practices such as limiting administrator access and using security plugins that detect CSRF attempts may help mitigate risk.