WPML Multilingual CMS (<= 4.9.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wpml-multilingual-cms--4.9.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 08:05:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWPML Multilingual CMS: Authentication Bypass via Race Condition (CVE-2026-76877)https://feed.craftedsignal.io/briefs/2026-11-wpml-auth-bypass/Tue, 10 Nov 2026 08:05:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wpml-auth-bypass/The WPML Multilingual CMS plugin for WordPress, in versions up to and including 4.9.7, is vulnerable to an authentication bypass via a race condition in the `process_iframe_request` function's language-per-domain SSO handler.The WPML Multilingual CMS plugin for WordPress (versions <= 4.9.7) contains a vulnerability in the process_iframe_request function. An authentication bypass occurs due to a race condition where the SSO handler generates a cross-domain sign-in token that is not properly bound to the user session after authentication cookies are discarded. An unauthenticated attacker can forge the wpml_sso_token_domain parameter and submit it to a language-domain endpoint, potentially gaining access to user accounts, including those of administrators, while the legitimate user is logging out.

]]>highadvisory