Live › vulnerability › CVE-2026-109927
Go to dashboardThe HIPAA Forms WordPress plugin before 3.3.2 does not check capabilities when handling a request that rebuilds its custom user role. A user who already holds that role can grant it administrator-level capabilities and escalate their privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the HIPAA Forms WordPress plugin before 3.3.2 that have users assigned the plugin's custom role. Sites without the plugin, or without accounts in that role, are not exposed through this flaw. Exploitation requires an existing account in that role, so the risk is mainly for sites that give out such accounts.
No product ranges from the sources yet.
3.3.2 are affected.3.3.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-109927")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.