CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Privilege Escalation via HIPAA Role Capability Update

ID

WPSEC-2026-1101

Plugin

HIPAA FORMS – Add HIPAA Compliant Webforms to Your WordPress Website (codemonkeys-hipaa-forms)

Affected

all versions before 3.3.2

Remediation

Update to 3.3.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness

CWE-269

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16

Attack surface

CM HIPAA Forms on WPSec AttackSurface

Fix released

2026-10-14

Published

2026-10-16

Description

The codemonkeys-hipaa-forms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to a missing capability check in the cm_hipaa_update_user_role AJAX action, which was protected only by a nonce that the plugin also gives to users of its HIPAA Forms staff role. This makes it possible for authenticated attackers with the HIPAA Forms role, which by default only has the read and access_hipaa_forms capabilities, to grant that role arbitrary capabilities such as manage_options, edit_users, promote_users and install_plugins, and so take over the site.

References

• https://wpsec.com/vuln/WPSEC-2026-1101/
• https://plugins.svn.wordpress.org/codemonkeys-hipaa-forms/tags/3.3.2/
• https://wordpress.org/plugins/codemonkeys-hipaa-forms/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS