Not on CISA's list of exploited flaws, and not in the news we track.
0.19%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-110959. Nothing runs until you send it.
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.