CVE-2026-110959: Descope < 1.2.0 - Unauthenticated Account Takeover

Q: Which sites are exposed to account takeover?

Sites using the Descope WordPress plugin at a version earlier than 1.2.0 are exposed. Any existing WordPress account may be targeted, including administrator accounts.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They need to supply a non-empty token and the email address of an existing WordPress account.

Q: How can I tell whether my site may be affected?

Check whether the Descope WordPress plugin is installed and whether its version is earlier than 1.2.0. If so, the plugin's session creation may accept non-empty tokens without validating them.

Published Nov 12, 2026

Updated

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to account takeover?

Sites using the Descope WordPress plugin at a version earlier than 1.2.0 are exposed. Any existing WordPress account may be targeted, including administrator accounts.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They need to supply a non-empty token and the email address of an existing WordPress account.

How can I tell whether my site may be affected?

Check whether the Descope WordPress plugin is installed and whether its version is earlier than 1.2.0. If so, the plugin's session creation may accept non-empty tokens without validating them.

CVE-2026-110959: Descope < 1.2.0 - Unauthenticated Account Takeover

Event History

Frequently Asked Questions

Which sites are exposed to account takeover?

What does an attacker need to exploit this issue?

How can I tell whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to account takeover?

What does an attacker need to exploit this issue?

How can I tell whether my site may be affected?