{"id":"CVE-2026-110959","kind":"vulnerability","aliases":["CVE-2026-110959"],"related":[],"title":"Descope WordPress plugin: unauthenticated login as any account, including admins","description":"The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.","summary":"The Descope WordPress plugin before 1.2.0 does not check the authentication token it receives before creating a WordPress session, so any non-empty token is accepted. An unauthenticated attacker who knows an account's email address can get a logged-in session for that account, including an administrator.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["descope","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.2.0-or-later"],"how_to_check":"- Check the installed Descope plugin version in the WordPress admin under Plugins, or with `wp plugin get descope --field=version` if WP-CLI is available.\n- Flag any site running a Descope plugin version below `1.2.0`.","fix":"- Descope WordPress plugin: update to `1.2.0` or later.","status":"open","published_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:03+00:00","updated_at":"2026-11-12T06:38:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T06:38:03Z","model":"claude-haiku-5-5","output":{"fix":"- Descope WordPress plugin: update to `1.2.0` or later.","reach":"internet","title":"Descope WordPress plugin: unauthenticated login as any account, including admins","impact":"high","summary":"The Descope WordPress plugin before 1.2.0 does not check the authentication token it receives before creating a WordPress session, so any non-empty token is accepted. An unauthenticated attacker who knows an account's email address can get a logged-in session for that account, including an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","descope","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as any account, including administrators, and takes over the site","analyst_note":"","how_to_check":"- Check the installed Descope plugin version in the WordPress admin under Plugins, or with `wp plugin get descope --field=version` if WP-CLI is available.\n- Flag any site running a Descope plugin version below `1.2.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.2.0-or-later"],"who_is_affected":"Sites running the Descope WordPress plugin before 1.2.0 that use it for login. The flaw is in the plugin's token handling during session creation, so any site with the vulnerable plugin active and reachable from the internet is exposed. Sites without the plugin, or running 1.2.0 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000738,"input_tokens":4534,"output_tokens":569,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110959':13A,16A '-2026':12A,15A '1.2.0':28B,78C 'accept':49B,92C 'account':8A,56B,69B,109C,116C 'address':59B,119C 'admin':10A 'administr':72B,112C 'attack':52B,101C 'authent':33B,83C 'check':31B 'creat':38B,88C 'cve':11A,14A 'descop':1A,17B,24B,74C 'email':58B,118C 'empti':46B,96C 'exist':108C 'get':61B 'host':21B 'includ':9A,70B,110C 'know':54B 'log':64B 'logged-in':63B 'login':5A 'non':45B,95C 'non-empti':44B,94C 'obtain':103C 'packag':18B 'plugin':3A,26B,76C 'receiv':36B,86C 'self':20B 'self-host':19B 'session':41B,66B,91C,105C 'suppli':114C 'token':34B,47B,84C,97C 'unauthent':4A,51B,100C 'valid':81C 'wordpress':2A,22B,25B,40B,75C,90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Descope WordPress plugin before 1.2.0 that use it for login. The flaw is in the plugin's token handling during session creation, so any site with the vulnerable plugin active and reachable from the internet is exposed. Sites without the plugin, or running 1.2.0 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","descope","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110959':13A,16A '-2026':12A,15A 'account':8A 'admin':10A 'cve':11A,14A 'descop':1A 'includ':9A 'login':5A 'plugin':3A 'unauthent':4A 'wordpress':2A","search_b":"'1.2.0':28B 'accept':49B 'account':56B,69B 'address':59B 'administr':72B 'attack':52B 'authent':33B 'check':31B 'creat':38B 'descop':17B,24B 'email':58B 'empti':46B 'get':61B 'host':21B 'includ':70B 'know':54B 'log':64B 'logged-in':63B 'non':45B 'non-empti':44B 'packag':18B 'plugin':26B 'receiv':36B 'self':20B 'self-host':19B 'session':41B,66B 'token':34B,47B 'unauthent':51B 'wordpress':22B,25B,40B","search_c":"'1.2.0':78C 'accept':92C 'account':109C,116C 'address':119C 'administr':112C 'attack':101C 'authent':83C 'creat':88C 'descop':74C 'email':118C 'empti':96C 'exist':108C 'includ':110C 'non':95C 'non-empti':94C 'obtain':103C 'plugin':76C 'receiv':86C 'session':91C,105C 'suppli':114C 'token':84C,97C 'unauthent':100C 'valid':81C 'wordpress':75C,90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110959","severity":null,"published_at":"2026-11-12T06:17:11+00:00","modified_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}