CVE-2026-2688

MediumCVSS 6.5

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The HIPAA FORMS WordPress plugin before version 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Risk Assessment

The risk includes unauthorized access to administrative functions and sensitive data, potentially leading to confidentiality and integrity compromise.

Recommendation

Update the HIPAA FORMS plugin to version 3.2.0 or later, which removes the hardcoded parameter and enforces nonce validation.

Other vulnerabilities in HIPAA FORMS

CVE-2026-109927High
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

Original NVD description (English source)

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS