CVE-2026-2688 in HIPAA Forms Plugin

الملخص

بحسب MITRE • 02/09/2026

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• مسؤول: WPScan
• حجز: 18/02/2026
• إفشاء: 02/09/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-398145
• CPE: جاهز
• CWE: CWE-863 (مؤكد)
• CVSS: 6.5 (CNA)
• EPSS: 0.00000
• KEV: لا
• النشاطات: منخفض
• القطاع: Hostingprovider

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-2688
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-2688
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-2688/