CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Insecure Direct Object Reference to Unassigned Form Submissions
- ID
- WPSEC-2026-1099
- Plugin
- HIPAA FORMS – Add HIPAA Compliant Webforms to Your WordPress Website (codemonkeys-hipaa-forms)
- Affected
- all versions before 3.3.2
- Remediation
- Update to 3.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- CM HIPAA Forms on WPSec AttackSurface
- Fix released
- Published
Description
The codemonkeys-hipaa-forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.1. This is due to the record-level AJAX actions (such as cm_hipaa_get_submitted_form, cm_hipaa_export_form, cm_hipaa_bulk_export_forms, cm_hipaa_submit_note and cm_hipaa_archive_form) not checking the user-supplied form_id against the per-form setting that limits a form's submissions to specific users or to the user selected in the submission. This makes it possible for authenticated attackers with the HIPAA Forms role to view, export, annotate and archive form submissions, which can contain protected health information, that the site administrator has not made visible to them.
References
- https://wpsec.com/vuln/WPSEC-2026-1099/
- https://plugins.svn.wordpress.org/codemonkeys-hipaa-forms/tags/3.3.2/
- https://wordpress.org/plugins/codemonkeys-hipaa-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS