Descope WordPress plugin: authentication bypass (CVE-2026-110959)
A vulnerability, CVE-2026-110959 (CVSS 9.8), was published for the Descope WordPress plugin. The plugin does not validate the authentication token before creating a WordPress session and accepts any non-empty token.
Checked in Shield: no
Who is affected
WordPress sites running the Descope plugin earlier than version 1.2.0. An unauthenticated attacker can get a session for any existing account, including an administrator, by supplying that account's email address.
How to check
In the WordPress admin, open the Plugins page and find Descope. If the installed version is lower than 1.2.0, the site is affected.
How to fix
A fix is available in version 1.2.0. Update the plugin to 1.2.0 or later.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet. Source: the NVD entry for CVE-2026-110959.
