The HIPAA Forms WordPress plugin versions older than 3.3.2 lacks a capability check during a role‑rebuilding request. An attacker who already holds the custom HIPAA Forms user role can trigger this rebuild, causing the role to be granted administrator‑level capabilities. The result is that the attacker gains full administrative control over the WordPress site, compromising confidentiality, integrity, and availability of the entire CMS.

This flaw affects the WordPress HIPAA Forms plugin (unknown vendor) in all releases prior to 3.3.2. Users who have installed these earlier versions and have the custom HIPAA Forms role are susceptible.

The vulnerability is exploitable by authenticated users with the custom role, as it is triggered by a role‑rebuilding function that does not verify proper privileges. There is no publicly available exploit, and the EPSS score of 0.0018 indicates a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. However, because an attacker can gain full administrative access, the risk is high. The likely attack vector is via the plugin’s exposed functionality, which an authenticated user can invoke.