CVE-2026-109927: CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CM HIPAA Formsto a version that resolves this vulnerability.Fixed in 3.3.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must already hold the plugin's custom hipaa_forms+ role. The issue allows that user to modify the role's capabilities and obtain administrator-level privileges.
Are sites using an earlier plugin release affected by default?
The affected condition is present in CM HIPAA Forms versions before 3.3.2. Exploitation additionally depends on an attacker having an account assigned the hipaa_forms+ custom role.
What is the immediate mitigation if upgrading is not possible?
Remove the hipaa_forms+ role from untrusted users, since holding that role is required for exploitation. Review accounts assigned this role and limit it to trusted administrators until the plugin can be updated.