Is CVE-2026-2688 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-2688?

CVE-2026-2688 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-2688

Description

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.