CVE-2026-110959
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 12, 2026
Vendor
unknown
Description
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.