External risk intelligence

Descope WordPress Plugin Session Hijacking Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-110959

This vulnerability affects a WordPress plugin, which is typically deployed on web servers to provide public-facing website or application functionality. Because it enables authentication bypass on a web-accessible platform, the vulnerable surface is commonly exposed to the public internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Descope WordPress plugin. This issue allows unauthenticated attackers to gain full administrative access to WordPress sites by exploiting a flaw in how authentication tokens are handled. The potential for unauthorized control over website content and data presents a significant risk.

Unauthenticated access to any user account.
Enables unauthorized control of websites.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a request with an email address and any non-empty token. This bypasses the plugin's authentication check, allowing the attacker to create a session for any user account, including an administrator. The attack can lead to unauthorized access and control over the WordPress site.

No authentication required.
Sending email and a token.
Full account takeover possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain access to any user account, including administrator accounts, on a vulnerable WordPress site. This is possible because the plugin improperly validates authentication tokens before creating a session. Supported conditions for this risk include when the affected plugin is installed and an attacker knows the email address of an existing account on the site.

User accounts and site administration.
An attacker can send a crafted token.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership The Descope WordPress plugin's authentication bypass vulnerability requires immediate attention from teams managing WordPress instances. The first practical step is to identify all WordPress sites using this plugin, determine their exposure and business criticality, and then locate the accountable owner for each instance. Remediation planning should be risk-based, prioritizing critical or externally facing sites.

WordPress site owners should own the issue.
Verify plugin usage and site exposure first.
Plan remediation based on site criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Descope WordPress plugin?

The Descope WordPress plugin is an add-on that integrates the Descope authentication platform with WordPress sites. It is typically used to manage user logins, handle identity verification, and simplify session management, allowing administrators to use Descope's identity services instead of standard WordPress login methods.

Why is CVE-2026-110959 considered a serious vulnerability?

This flaw is classified under CWE-287, or Improper Authentication. In this specific case, the plugin fails to verify the validity of authentication tokens before granting access. Because it accepts any non-empty token, an attacker can bypass the login process entirely to masquerade as any registered user, including site administrators.

How does an attacker trigger this authentication bypass?

An attacker triggers this by providing an email address associated with an existing site account along with any arbitrary, non-empty token. The vulnerability does not require the attacker to possess a legitimate session or password. Note that simply having the plugin installed is not enough; the attacker must specifically target the plugin's flawed token validation mechanism to gain unauthorized access.

Is my website at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is highly relevant because the Descope plugin is designed for web servers, making it typically accessible via the public internet. If your WordPress site is internet-facing, it is likely exposed to this attack. You should prioritize assessing your site's connectivity to determine if this risk is reachable by unauthorized parties.

What should I do to secure my WordPress site?

Start by identifying every WordPress instance in your environment that has the Descope plugin active. Once identified, evaluate the business criticality and network exposure of those sites to prioritize your response. Consult the official vendor channels for an update to version 1.2.0 or higher, which addresses the token validation flaw.

References

wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.