Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-2688CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
Medium 6.5
In plain English
A medium-severity incorrect authorization in HIPAA FORMS from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 70.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | HIPAA FORMS | 0 – before 3.2.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/779304f2-7dc2-4f12-b134-dede9a0c5eb6/ exploit, vdb-entry, technical-description