Descope WordPress plugin critical authentication flaw discovered

A critical flaw in the Descope WordPress plugin was published on 12 Nov 2026. The vulnerability allows an unauthenticated attacker to create a WordPress session for any existing account by supplying a non‑empty token, effectively granting admin access. The NVD lists a CVSS score of 9.8 and the CVE is not yet in the CISA KEV catalog, nor is there a public exploit. The EPSS probability rose from 0.19 % to 0.42 % during the two‑day window, indicating growing analyst attention. Descope has not yet released a fixed version, so the only defensive action is to upgrade the plugin to 1.2.0 or later as soon as a patch is issued. Keep an eye on vendor advisories for an update. Refer to the NVD record for full details: CVE‑2026‑110959 NVD record.