medium6.5
CVE-2026-2688
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests.
Impact
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
Affected products
| Product | Affected versions |
|---|---|
| HIPAA FORMS WordPress Plugin | before 3.2.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.