Veille CVE

Recherche « Unknown HIPAA FORMS »

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown HIPAA FORMS » ✕
  1. CVE-2026-109927 7.2 Élevée

    Unknown HIPAA Forms

    The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

  2. CVE-2026-2688 6.5 Moyenne

    Unknown HIPAA FORMS

    The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.