WPML Multilingual CMS: Authentication Bypass via Race Condition (CVE-2026-76877)
The WPML Multilingual CMS plugin for WordPress, in versions up to and including 4.9.7, is vulnerable to an authentication bypass via a race condition in the `process_iframe_request` function's language-per-domain SSO handler.
CVE search metadata
CVE search record: CVE-2026-76877. Severity: high. CVSS: 8.1. KEV: no. Product: WPML Multilingual CMS (<= 4.9.7). Brief: WPML Multilingual CMS: Authentication Bypass via Race Condition (CVE-2026-76877). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wpml-auth-bypass/
Triage facts
Revision 1- Applicability
- WPML Multilingual CMS (<= 4.9.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 08:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The WPML Multilingual CMS plugin for WordPress (versions <= 4.9.7) contains a vulnerability in the process_iframe_request function. An authentication bypass occurs due to a race condition where the SSO handler generates a cross-domain sign-in token that is not properly bound to the user session after authentication cookies are discarded. An unauthenticated attacker can forge the wpml_sso_token_domain parameter and submit it to a language-domain endpoint, potentially gaining access to user accounts, including those of administrators, while the legitimate user is logging out.