Privilege Escalation Flaw in HIPAA Forms Plugin for WordPress
CVE-2026-109927
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-109927?
The HIPAA Forms plugin for WordPress, prior to version 3.3.2, contains a vulnerability that allows users with certain custom roles to elevate their privileges. The plugin fails to implement adequate capability checks when processing requests to rebuild custom user roles. As a result, an attacker holding a specific role could unknowingly grant themselves administrator-level capabilities, potentially compromising the security of the entire WordPress site.
Affected Version(s)
HIPAA Forms 0 < 3.3.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.