CM HIPAA Forms <= 3.3.1 - Unauthenticated Email Content Injection via Form Submission Notification Parameters
- ID
- WPSEC-2026-1100
- Plugin
- HIPAA FORMS – Add HIPAA Compliant Webforms to Your WordPress Website (codemonkeys-hipaa-forms)
- Affected
- all versions before 3.3.2
- Remediation
- Update to 3.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- CM HIPAA Forms on WPSec AttackSurface
- Fix released
- Published
Description
The codemonkeys-hipaa-forms plugin for WordPress is vulnerable to Email Content Injection via the cm_hipaa_submit_caldera_form and cm_hipaa_submit_gravity_form AJAX actions in all versions up to, and including, 3.3.1. This is due to the notification_option, notification_sendto, notification_from_name, notification_from_email, notification_subject and notification_message request parameters overriding the form's saved notification settings. This makes it possible for unauthenticated attackers, by submitting a HIPAA-enabled form, to make the site send an HTML notification email with the recipients, sender, subject and content they choose, which can be used for phishing or spam.
References
- https://wpsec.com/vuln/WPSEC-2026-1100/
- https://plugins.svn.wordpress.org/codemonkeys-hipaa-forms/tags/3.3.2/
- https://wordpress.org/plugins/codemonkeys-hipaa-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS