CVE-2026-109927 — CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role

CVE-2026-109927

CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role PUBLISHED

Description (CNA)

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

Affected (CNA)

Vendor / product	Versions
Unknown / HIPAA Forms	affected 0 before 3.3.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f08997a3-9034-4470-b5a9-ceb0860108ed/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.