Unrated severityNVD Advisory· Published Nov 12, 2026
CVE-2026-110959
CVE-2026-110959
Description
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.2.0+ 1 more
- (no CPE)range: <1.2.0
- (no CPE)range: <1.2.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.