CVE-2026-76877

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the processiframerequest function's language-per-domain SSO handler generating the cross-domain sign-in token via wpcreatenonce'wpmlsso'...

EUVD-2026-120823

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the processiframerequest function's language-per-domain SSO handler generating the cross-domain sign-in token via wpcreatenonce'wpmlsso'...

CVE-2026-76877

The WPML Multilingual CMS plugin for WordPress (versions up to and including 4.9.7 ) is vulnerable to an Authentication Bypass via Race Condition in its language-per-domain SSO handler. The vulnerability exists because the process_iframe_request function generates a cross-domain sign-in token usi...

CVE-2026-76877 WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the processiframerequest function's language-per-domain SSO handler generating the cross-domain sign-in token via wpcreatenonce'wpmlsso'...