CM CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review CM CVE published 2026-10-22

CVE-2026-109927

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges. This vulnerability affects WordPress installations with the HIPAA Forms plugin, potentially allowing users with existing custom roles to escal [truncated]