The HIPAA FORMS WordPress plugin prior to version 3.2.0 contains a hardcoded authentication bypass that allows any user to call protected AJAX endpoints without providing a valid nonce or authentication credentials. This bypass arises from the server explicitly checking for a specific hardcoded parameter and, when present, skipping nonce validation entirely, thereby granting unlimited access to privileged functionality. The flaw therefore poses a moderate risk of unauthorized data modification or disclosure through the vulnerable AJAX handlers, as described by CWE‑863.

The vulnerability affects the WordPress plugin named HIPAA FORMS on all installations using versions older than 3.2.0. No specific sub‑versions are listed in the advisory, so any instance running a pre‑3.2.0 build is potentially vulnerable.

The CVSS score of 6.5 indicates a medium impact, and the EPSS score is not available, suggesting no community data on exploitation frequency. The flaw is not listed in the CISA KEV catalog, but the explicit bypass of nonce checks makes it easy for an unauthenticated attacker to construct HTTP requests to the affected AJAX endpoints. The attack requires only knowledge of the hardcoded parameter value, making the exploit straightforward once discovered. Given the medium severity and the simplicity of the attack path, this vulnerability warrants timely remediation.