CVE-2026-2688: CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
Published Sep 2, 2026
·Updated
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
Affected Software
1 affected component
WordPress plugin "HIPAA FORMS"<3.2.0
Event History
Sep 2, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
WordPress sites using the HIPAA FORMS plugin before version 3.2.0 are affected. The issue concerns protected AJAX endpoints in that plugin.
2
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can bypass nonce validation by supplying the plugin's hardcoded parameter with AJAX requests.