---
id: CVE-2026-109927
title: >-
  CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via
  cm_hipaa_update_user_role
summary: >-
  The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability
  check when handling a request that rebuilds its own custom user role, allowing
  a user who already holds that role to grant it administrator-level
  capabilities an…
severity: none
cwe:
  - CWE-269
product: HIPAA Forms
affected:
  - hipaa_forms < 3.3.2
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T06:00:17.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109927'
references:
  - url: 'https://wpscan.com/vulnerability/f08997a3-9034-4470-b5a9-ceb0860108ed/'
tags:
  - cve.org
ingestedAt: '2026-10-22T06:30:48.517Z'
---

## Overview

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

## Affected

- `hipaa_forms < 3.3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.