EUVD-2026-120823

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the processiframerequest function's language-per-domain SSO handler generating the cross-domain sign-in token via wpcreatenonce'wpmlsso'...