WordPress Plugin Vulnerabilities

CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role

Description

The plugin does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

Proof of Concept

Affects Plugins

Plugin icon
codemonkeys-hipaa-forms
Fixed in 3.3.2

References

CVE
CVE-2026-109927

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
f08997a3-9034-4470-b5a9-ceb0860108ed

Timeline

Publicly Published
2026-10-20 (about 2 days ago)
Added
2026-10-20 (about 1 day ago)
Last Updated
2026-10-20 (about 1 day ago)

Other

Published
Title
Published
2024-12-11
Title
Wp NssUser Register <= 1.0.0 - Unauthenticated Privilege Escalation
Published
2026-09-18
Title
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
Published
2021-06-28
Title
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
Published
2026-08-11
Title
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
Published
2026-08-31
Title
Nokri - Job Board WordPress Theme < 1.6.7 - Unauthenticated Privilege Escalation via 'token' Parameter