Aller au contenu
Se connecter
6.5 Moyenne

CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter…

Description

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Produits et versions touchés

Produit Versions touchées Corrigé en
HIPAA FORMS 3.2 premières → < 3.2.0 3.2.0

Autres CVE de HIPAA FORMS

Les 2 CVE de HIPAA FORMS →
CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that… 7.2 Élevée
Suivre cette CVE