# CM HIPAA Forms <= 3.3.1 - Authenticated (HIPAA Forms Role+) Privilege Escalation via HIPAA Role Capability Update

- **ID:** WPSEC-2026-1101
- **Plugin:** HIPAA FORMS – Add HIPAA Compliant Webforms to Your WordPress Website (`codemonkeys-hipaa-forms`), https://wordpress.org/plugins/codemonkeys-hipaa-forms/
- **Affected versions:** all versions before 3.3.2
- **Fixed in:** 3.3.2 (Update to 3.3.2 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/codemonkeys-hipaa-forms
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1101/

## Description

The codemonkeys-hipaa-forms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to a missing capability check in the cm_hipaa_update_user_role AJAX action, which was protected only by a nonce that the plugin also gives to users of its HIPAA Forms staff role. This makes it possible for authenticated attackers with the HIPAA Forms role, which by default only has the read and access_hipaa_forms capabilities, to grant that role arbitrary capabilities such as manage_options, edit_users, promote_users and install_plugins, and so take over the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-1101/
- https://plugins.svn.wordpress.org/codemonkeys-hipaa-forms/tags/3.3.2/
- https://wordpress.org/plugins/codemonkeys-hipaa-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1101/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.