Skip to content

CVE-2026-110959 Descope < 1.2.0 - Unauthenticated Account Takeover

CriticalCVSS 9.8
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry