{"id":"CVE-2026-109927","kind":"vulnerability","aliases":["CVE-2026-109927"],"related":[],"title":"HIPAA Forms WordPress plugin: missing capability check lets users escalate to admin","description":"The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.","summary":"The HIPAA Forms WordPress plugin before 3.3.2 does not check capabilities when handling a request that rebuilds its custom user role. A user who already holds that role can grant it administrator-level capabilities and escalate their privileges.","severity":"high","cvss":7.2,"epss":0.00402,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-custom-role-users","plugin-not-installed"],"how_to_check":"- Check the installed HIPAA Forms plugin version in the WordPress admin under Plugins; versions below `3.3.2` are affected.\n- Review user accounts holding the plugin's custom role for unexpected administrator capabilities.","fix":"- Update the HIPAA Forms plugin to `3.3.2` or later.\n- Review existing users with the plugin's custom role and remove any unexpected privileges.","status":"open","published_at":"2026-10-22T06:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:27:54+00:00","updated_at":"2026-10-25T03:27:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:27:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the HIPAA Forms plugin to `3.3.2` or later.\n- Review existing users with the plugin's custom role and remove any unexpected privileges.","reach":"internet","title":"HIPAA Forms WordPress plugin: missing capability check lets users escalate to admin","impact":"high","summary":"The HIPAA Forms WordPress plugin before 3.3.2 does not check capabilities when handling a request that rebuilds its custom user role. A user who already holds that role can grant it administrator-level capabilities and escalate their privileges.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged role holder gains administrator capabilities on the WordPress site.","analyst_note":"Confirm the affected version range and the exact role and request name from the NVD entry or the plugin changelog to write a precise how-to-check.","how_to_check":"- Check the installed HIPAA Forms plugin version in the WordPress admin under Plugins; versions below `3.3.2` are affected.\n- Review user accounts holding the plugin's custom role for unexpected administrator capabilities.","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-custom-role-users"],"who_is_affected":"Sites running the HIPAA Forms WordPress plugin before 3.3.2 that have users assigned the plugin's custom role. Sites without the plugin, or without accounts in that role, are not exposed through this flaw. Exploitation requires an existing account in that role, so the risk is mainly for sites that give out such accounts.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":3341,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109927':15A,18A '-2026':14A,17A '3.3.2':33B,72C 'admin':12A 'administr':59B,102C 'administrator-level':58B,101C 'allow':90C 'alreadi':51B,94C 'capabl':6A,37B,61B,77C,104C 'check':7A,36B,78C 'custom':45B,87C 'cve':13A,16A 'escal':10A,63B,106C 'form':2A,29B,68C 'grant':56B,99C 'handl':39B,80C 'hipaa':1A,28B,67C 'hold':52B,95C 'host':22B 'let':8A 'level':60B,103C 'miss':5A 'packag':19B 'perform':75C 'plugin':4A,26B,31B,70C 'privileg':65B,108C 'rebuild':43B,84C 'request':41B,82C 'role':47B,54B,89C,97C 'self':21B 'self-host':20B 'user':9A,46B,49B,88C,92C 'wordpress':3A,23B,25B,30B,69C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the HIPAA Forms WordPress plugin before 3.3.2 that have users assigned the plugin's custom role. Sites without the plugin, or without accounts in that role, are not exposed through this flaw. Exploitation requires an existing account in that role, so the risk is mainly for sites that give out such accounts.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109927","severity":null,"published_at":"2026-10-22T06:17:13+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109927","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109927","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}