# CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Insecure Direct Object Reference to Unassigned Form Submissions

- **ID:** WPSEC-2026-1099
- **Plugin:** HIPAA FORMS – Add HIPAA Compliant Webforms to Your WordPress Website (`codemonkeys-hipaa-forms`), https://wordpress.org/plugins/codemonkeys-hipaa-forms/
- **Affected versions:** all versions before 3.3.2
- **Fixed in:** 3.3.2 (Update to 3.3.2 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/codemonkeys-hipaa-forms
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1099/

## Description

The codemonkeys-hipaa-forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.1. This is due to the record-level AJAX actions (such as cm_hipaa_get_submitted_form, cm_hipaa_export_form, cm_hipaa_bulk_export_forms, cm_hipaa_submit_note and cm_hipaa_archive_form) not checking the user-supplied form_id against the per-form setting that limits a form's submissions to specific users or to the user selected in the submission. This makes it possible for authenticated attackers with the HIPAA Forms role to view, export, annotate and archive form submissions, which can contain protected health information, that the site administrator has not made visible to them.

## References

- https://wpsec.com/vuln/WPSEC-2026-1099/
- https://plugins.svn.wordpress.org/codemonkeys-hipaa-forms/tags/3.3.2/
- https://wordpress.org/plugins/codemonkeys-hipaa-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1099/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.