CVE-2026-76877

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the process_iframe_request function's language-per-domain SSO handler generating the cross-domain sign-in token via wp_create_nonce('wpml_sso') on the logout landing page, where the browser has already discarded its authentication cookies — so wp_get_session_token() returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)> transient mapped to the victim's user_id with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on wp-login.php?action=logout, and because the is_iframe_request() gate conditions (the per-domain SSO started transient and domain-hash derived from the public constant SSO_NONCE) are fully computable within the 60-second SSO_TIMEOUT window, an unauthenticated attacker can submit the forged wpml_sso_token_domain parameter with a wpml_user_signed_in status to a secondary language-domain endpoint before the legitimate wpml_user_signed_out iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window.