CVE-2026-110959

Name of the Vulnerable Software and Affected Versions Descope WordPress plugin versions prior to 1.2.0

Description An issue exists where the plugin fails to validate the authentication token before creating a WordPress session. By providing a non-empty token and a target account's email address, an unauthenticated attacker can gain unauthorized access to any existing account, including those with administrator privileges.

Recommendations Update the Descope WordPress plugin to version 1.2.0.