The Child Height Predictor by Ostheimer WordPress plugin contains a Cross‑Site Request Forgery flaw that lets an unauthenticated attacker submit forged POST requests to the plugin’s settings form. Because the setting‑update handler does not verify a nonce, an administrator who follows a malicious link or visits a crafted page can change options such as unit preferences, which are then persisted to the database with update_option(). The flaw grants the attacker the ability to alter plugin configuration but does not allow execution of code or modification of other WordPress settings.

All installations of the Child Height Predictor by Ostheimer plugin up to and including version 1.3 are vulnerable. WordPress sites running any of those plugin versions are susceptible whenever the plugin’s settings page is available to administrators; no specific WordPress core versions are mentioned.

The CVSS score of 4.3 indicates moderate risk, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. EPSS data is not available, so the likelihood of exploitation is unclear, but the flaw can be abused through a simple malicious link or script that triggers a forged POST. The attacker does not need administrator credentials to craft the request, but practical exploitation requires an administrator to unknowingly submit the request. The threat is limited to the plugin’s configuration settings, which reduces overall damage but can still impact site operation.