Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-2688

CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown HIPAA FORMS

Default version status: unaffected

  • 0 to < 3.2.0affected

References