CVE-2026-109927
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
Risk Assessment
A user with a limited role could escalate privileges to administrator level, gaining full control over the site.
Recommendation
Update the HIPAA Forms plugin to version 3.3.2 or later. Check for unauthorized changes to user roles.
Other vulnerabilities in HIPAA Forms
Original NVD description (English source)
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS