CVE-2026-2688
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 02, 2026
Vendor
unknown
Description
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.