Skip to content
Sign in
6.5 Medium

CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter…

Description

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Affected products and versions

Product Affected versions Fixed in
HIPAA FORMS 3.2 earliest → < 3.2.0 3.2.0

Other CVEs of HIPAA FORMS

The 2 CVEs of HIPAA FORMS →
CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that… 7.2 High
Track this CVE