Skip to content
Sign in
7.2 High

CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that…

Description

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

Affected products and versions

Product Affected versions Fixed in
HIPAA FORMS 3.3 earliest → < 3.3.2 3.3.2

Other CVEs of HIPAA FORMS

The 2 CVEs of HIPAA FORMS →
CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter… 6.5 Medium
Track this CVE