CVE-2026-2688
Received Received - Intake

Authentication Bypass in HIPAA Forms WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-2688
EUVD
EUVD-2026-70037

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hipaa_forms hipaa_forms to 3.2.0 (exc)
cm_hipaa_forms plugin to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-2688 is a vulnerability in the HIPAA FORMS WordPress plugin before version 3.2.0. It allows unauthenticated attackers to bypass authentication by including a hardcoded parameter in AJAX requests. This bypasses nonce validation, letting attackers access protected endpoints without proper authorization.

Detection Guidance

Check the installed version of the HIPAA FORMS WordPress plugin. If it is below 3.2.0, the vulnerability is likely present. Inspect the plugin's JavaScript file (js/script.js) for the hardcoded parameter 'nononce=1' which bypasses authentication.

Impact Analysis

This vulnerability allows attackers to access sensitive endpoints like file uploads or form submissions without authentication. They could manipulate data, upload unauthorized files, or access protected patient information if the plugin is used in a healthcare context.

Compliance Impact

This vulnerability directly impacts HIPAA compliance as it allows unauthorized access to protected health information (PHI) through manipulated AJAX endpoints. It violates HIPAA's requirement for strict access controls and could lead to data breaches and non-compliance penalties.

Mitigation Strategies

Update the HIPAA FORMS plugin to version 3.2.0 or later immediately. Remove or restrict access to the hardcoded parameter 'nononce=1' in the plugin's JavaScript file. Review server logs for unauthorized AJAX requests with the 'nononce=1' parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart