CVE-2026-76877

Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.8

Description An authentication bypass exists in the language-per-domain Single Sign-On (SSO) handler. The issue occurs within the process iframe request() function during the logout process. When a user logs out, the system generates a cross-domain sign-in token using wp create nonce('wpml sso') on the logout landing page. Because authentication cookies are discarded at this stage, wp get session token() returns an empty string, causing the token to become a shared anonymous nonce instead of a user-bound secret. This token is then stored in a transient mapped to the victim's user id without binding to the specific sign-out action.

An unauthenticated attacker can derive the same token by triggering the logout confirmation flow on the wp-login.php?action=logout endpoint. By submitting a forged wpml sso token domain parameter with a wpml user signed in status to a secondary language-domain endpoint within the 60-second SSO TIMEOUT window, the attacker can trick the system into issuing authentication cookies for the victim. This allows attackers to gain unauthorized access to accounts, including those of administrators, while the user is logging out.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict or disable the use of the language-per-domain SSO feature.