CVE-2026-110959
Descope
Published 12 Nov 2026 · updated 12 Nov 2026 · Received
9.8 Critical · CVSS 3.1, CISA ADP
Description
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.