{"affected":[{"defaultStatus":"unaffected","product":"Descope","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-110959","cwes":["CWE-287"],"description":"The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/"}],"kev":null,"metrics":[],"modifiedAt":1794463206674,"publishedAt":1794463206674,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/"}],"remediation":[],"revision":"3c9e253e4bc8890de6ad868183730be60f4b2c3a21eaa730a4f6b3b2d9454638","sources":[{"modifiedAt":1794463206674,"name":"CNA: WPScan","retrievedAt":1794467305230,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110959"}],"ssvc":null,"status":"published","title":"Descope < 1.2.0 - Unauthenticated Account Takeover","updatedAt":1794467305230}