Authentication Flaw in Descope WordPress Plugin by Descope
CVE-2026-110959
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110959?
The Descope WordPress plugin prior to version 1.2.0 contains an authentication bypass vulnerability that allows an attacker with no authentication to generate a valid session for any existing user, including administrators. By supplying a non-empty authentication token, the attacker can exploit this vulnerability by simply providing an existing user's email address, leading to unauthorized access and potential security breaches.
Affected Version(s)
Descope 0 < 1.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.