Any Email, Admin Access: Descope WordPress Plugin CVE-2026-110959 Explained

What this session covers

Many WordPress sites add a “Sign in with Descope” button through the Descope plugin. CVE-2026-110959 (CVSS 9.8) is an unauthenticated account takeover in that plugin, in every version before 1.2.0. The login handler only checked that the session token sent by the browser was not empty. It never validated the token with Descope, and it chose the WordPress account by the email address the browser supplied, then set the login cookie. The handler is registered for visitors who are not logged in, so anyone on the internet can reach it. The issue was published by WPScan on 10 November 2026, credited to Muni Nitish Kumar Yaddala, and is fixed in version 1.2.0.

We rebuild the situation in our isolated lab, with the official 1.1 and 1.2.0 packages, and go through the response in five steps: check exposure, read the vendor's public fix, look for signs that the site was already hit, contain it and buy time, and patch and prove the fix is in the code. We close with a checklist you can run today.

Key takeaways

• Do not trust the version number alone. The 1.1 release still reports “1.0.0” in its plugin header. Anything below 1.2.0 is affected; the reliable test is whether public/class-descope-wp-public.php calls Descope's /v1/auth/validate endpoint.
• The fix moves trust to the server. In 1.2.0 every token is validated with Descope first, the email comes from the validated claims, and profile field mappings come from server settings only, with role and capability fields blocked.
• Look for traces before you clean up. POST requests to admin-ajax.php from unknown addresses, administrators you never created, and sessions you do not recognise in wp user session list.
• Contain, then patch. Deactivate the plugin, end sessions, remove unknown administrators, shuffle the salts and reset admin passwords. Then update to 1.2.0 and make sure the server can reach Descope over HTTPS, or sign-in fails closed.

About the lab

Everything runs on an isolated Docker network with no internet access, using WordPress 7.1.4 and the official plugin packages from wordpress.org. Accounts, addresses and log lines are invented lab data. The exploit itself is not shown; this is a defensive walkthrough only, and every command is run as the site user with WP-CLI.