What is the CVSS score of EUVD-2026-31038?

EUVD-2026-31038 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Child Height Predictor EUVD-2026-31038

| CVE-2026-6400 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-5gxf-gf9p-vp7j

WordPress CSRF Wordpress Plugin Child Height Predictor By Ostheimer

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:35 vuln.today

DescriptionCVE.org

The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().

AnalysisAI

Cross-Site Request Forgery in the Child Height Predictor by Ostheimer WordPress plugin (all versions through 1.3) allows unauthenticated remote attackers to modify plugin settings by tricking an authenticated administrator into visiting a malicious page. The vulnerability stems from a complete absence of nonce verification in the options() function - neither wp_nonce_field() in the form template nor check_admin_referer()/wp_verify_nonce() in the handler - meaning any forged POST request from an admin session will be accepted and persisted to the database. No public exploit has been identified at time of analysis, and CVSS scores this as medium severity (4.3), which aligns with the limited integrity impact (settings modification only, no confidentiality or availability loss).

Technical ContextAI

WordPress employs a nonce-based CSRF protection mechanism requiring forms that modify state to include a wp_nonce_field() token in the rendered HTML and a corresponding check_admin_referer() or wp_verify_nonce() call in the processing handler. The affected plugin, identified via CPE cpe:2.3:a:helpstring:child_height_predictor_by_ostheimer:*:*:*:*:*:*:*:*, fails to implement either half of this pattern in its options() function (childheight.php lines 135 and 149 per Wordfence-referenced source). CWE-352 (Cross-Site Request Forgery) describes exactly this root cause: a web application does not sufficiently verify that a request was intentionally submitted by the authenticated user, enabling a third-party site to forge and submit state-changing requests on their behalf. The exploitable action is a POST to the plugin settings handler that calls update_option() to persist attacker-controlled values such as unit preferences to the WordPress options table.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point only to the vulnerable source code in the plugin repository trunk and the 1.3 tag, with no patched version confirmed. WordPress site administrators should immediately deactivate and remove the Child Height Predictor by Ostheimer plugin until a patched release is available. As a compensating control, restricting access to the WordPress admin dashboard via IP allowlist (e.g., via .htaccess or server-level firewall rules) reduces the attack surface by limiting which sessions can be socially engineered; the trade-off is operational friction for distributed admin teams. Additionally, training administrators to avoid clicking unsolicited links while authenticated to WordPress reduces social engineering exposure. Monitor the plugin's WordPress.org repository page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1681a8-5f2e-45f1-96d9-797b13644607 for patch availability.