WPML Multilingual CMS (<= 4.9.7)

The WPML Multilingual CMS plugin for WordPress, in versions up to and including 4.9.7, is vulnerable to an authentication bypass via a race condition in the `process_iframe_request` function's language-per-domain SSO handler.