Authentication Bypass Vulnerability in WPML Multilingual CMS Plugin for WordPress

CVE-2026-76877

What is CVE-2026-76877?

The WPML Multilingual CMS plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit an authentication bypass due to a race condition. This issue arises within the process_iframe_request function, where the cross-domain sign-in token for users is improperly generated during the logout process. When users log out, the plugin generates a token with insufficient user-binding, leading to a scenario where attackers can predictably create the same token and potentially hijack user sessions. The race condition window provides an opportunity for attackers to interfere with active sessions, gaining unauthorized access to user accounts—including administrative ones—while their legitimate users are in the process of logging out.

References