Executive brief
CM HIPAA Forms is a WordPress plugin used to manage HIPAA-compliant patient forms and data collection. The plugin contains a hardcoded authentication bypass that allows unauthenticated attackers to directly access protected AJAX endpoints and retrieve sensitive patient health information (PHI) stored in AWS S3, bypassing all security validation checks.
Technical details
The vulnerability is an authentication bypass in the plugin's AJAX request handling. The vulnerable code hardcodes a parameter (nononce=1) that is checked server-side to skip nonce validation entirely, allowing unauthenticated access to protected endpoints like cm_hipaa_get_file_upload_url and cm_hipaa_validate_account. The bypass affects multiple AJAX actions and can be exploited remotely over the network by sending a simple POST request with the hardcoded parameter value. An attacker can retrieve AWS S3 pre-signed URLs and access patient PHI without authentication. The vulnerability was fixed in version 3.2.0 and confirmed patched by the vendor.
Affected products
- Code Monkeys HIPAA Forms before 3.2.0
Timeline
- 2026-03-23: disclosed
- 2026-03-23: patched: Fixed in version 3.2.0
- 2026-09-02: advisory