{"id":"CVE-2026-76877","kind":"vulnerability","aliases":["CVE-2026-76877"],"related":[],"title":"WPML plugin: a logout race lets attackers log in as other users","description":"The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window.","summary":"The WPML Multilingual CMS plugin for WordPress, up to and including 4.9.7, derives a predictable single-sign-on token during logout. An unauthenticated attacker can forge the token within a 60-second window and get WordPress login cookies issued for a user who is logging out, including administrators.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpml"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WPML version in the WordPress plugin list or `wp plugin get sitepress-multilingual-cms --field=version` if WP-CLI is available\n- Confirm whether the multi-domain language-per-domain SSO feature is in use; the sources do not say how to test it","fix":"- WPML up to and including `4.9.7` is affected; the sources do not state a fixed version","status":"open","published_at":"2026-11-10T07:16:52+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","triaged_at":"2026-11-10T07:21:00+00:00","updated_at":"2026-11-10T07:21:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T07:21:00Z","model":"claude-haiku-5-5","output":{"fix":"- WPML up to and including `4.9.7` is affected; the sources do not state a fixed version","reach":"internet","title":"WPML plugin: a logout race lets attackers log in as other users","impact":"high","summary":"The WPML Multilingual CMS plugin for WordPress, up to and including 4.9.7, derives a predictable single-sign-on token during logout. An unauthenticated attacker can forge the token within a 60-second window and get WordPress login cookies issued for a user who is logging out, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpml","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as an administrator during logout","analyst_note":"Confirm the fixed WPML version and whether the language-per-domain SSO feature must be enabled; check the NVD and WPML release notes.","how_to_check":"- Check the installed WPML version in the WordPress plugin list or `wp plugin get sitepress-multilingual-cms --field=version` if WP-CLI is available\n- Confirm whether the multi-domain language-per-domain SSO feature is in use; the sources do not say how to test it","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running WPML up to and including 4.9.7 that use its cross-domain single sign-on across language domains are exposed. The sources do not say whether sites without that feature are safe, so unknown. Sites that do not run WPML can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":5015,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76877':15A,18A '12':162C '4.9.7':36B,95C '60':56B,257C 'access':316C 'account':318C 'action':202C,224C 'activ':325C 'administr':73B,322C 'alreadi':136C 'anonym':157C 'attack':7A,49B,209C,264C,313C 'authent':84C,139C,299C 'bind':195C 'bound':170C 'browser':134C 'bypass':85C 'caus':297C 'client':205C 'cms':28B,77C 'collaps':153C 'comput':254C 'condit':88C,233C 'confirm':220C 'constant':249C 'cooki':63B,140C,300C 'creat':123C 'cross':115C 'cross-domain':114C 'current':161C 'cve':13A,16A 'deriv':37B,212C,245C 'discard':137C 'domain':109C,116C,184C,237C,243C,272C,286C 'domain-hash':242C 'due':98C 'empti':148C 'endpoint':287C 'fire':296C 'flow':221C 'forg':51B,268C 'fulli':253C 'function':104C 'gain':315C 'gate':232C 'generat':112C 'get':60B,143C 'handler':111C 'hash':244C 'host':22B 'hour':163C 'id':192C 'ident':214C 'ifram':102C,230C,295C 'includ':35B,72B,94C,321C 'independ':211C 'issu':64B,303C 'land':130C 'languag':107C,285C 'language-domain':284C 'language-per-domain':106C 'legitim':290C 'let':6A 'log':8A,70B,330C 'login':62B 'logout':4A,46B,129C,219C,225C 'make':308C 'map':186C 'multilingu':27B,76C 'nonc':124C,158C,251C 'packag':19B 'page':131C 'paramet':273C 'per':108C,236C 'per-domain':235C 'plugin':2A,29B,78C 'possibl':310C 'predict':39B 'process':101C,328C 'public':248C 'race':5A,87C,334C 'rather':165C 'request':103C,204C,231C 'return':146C 'second':57B,258C 'secondari':283C 'secret':171C 'self':21B 'self-host':20B 'session':144C 'sha256':181C 'share':156C 'sign':42B,118C,200C,278C,293C 'sign-in':117C 'sign-out':199C 'singl':41B 'single-sign-on':40B 'specif':198C 'sso':110C,126C,179C,183C,238C,250C,259C,270C 'start':239C 'status':280C 'store':174C 'string':149C 'submit':266C 'tick':164C 'timeout':260C 'token':44B,53B,120C,145C,152C,215C,271C 'transient':185C,240C 'trigger':217C 'unauthent':48B,208C,263C,312C 'user':12A,67B,169C,180C,191C,277C,292C,320C 'user-bound':168C 'version':90C 'via':86C,121C 'victim':189C,306C 'vulner':82C 'window':58B,261C,335C 'within':54B,255C 'wordpress':23B,31B,61B,80C,298C 'wp':122C,142C 'wp-login.php':223C 'wpml':1A,24B,26B,75C,125C,178C,182C,269C,276C,291C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WPML up to and including 4.9.7 that use its cross-domain single sign-on across language domains are exposed. The sources do not say whether sites without that feature are safe, so unknown. Sites that do not run WPML can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpml"],"campaign_type":null,"search_a":"'-2026':14A,17A '-76877':15A,18A 'attack':7A 'cve':13A,16A 'let':6A 'log':8A 'logout':4A 'plugin':2A 'race':5A 'user':12A 'wpml':1A","search_b":"'4.9.7':36B '60':56B 'administr':73B 'attack':49B 'cms':28B 'cooki':63B 'deriv':37B 'forg':51B 'get':60B 'host':22B 'includ':35B,72B 'issu':64B 'log':70B 'login':62B 'logout':46B 'multilingu':27B 'packag':19B 'plugin':29B 'predict':39B 'second':57B 'self':21B 'self-host':20B 'sign':42B 'singl':41B 'single-sign-on':40B 'token':44B,53B 'unauthent':48B 'user':67B 'window':58B 'within':54B 'wordpress':23B,31B,61B 'wpml':24B,26B","search_c":"'12':162C '4.9.7':95C '60':257C 'access':316C 'account':318C 'action':202C,224C 'activ':325C 'administr':322C 'alreadi':136C 'anonym':157C 'attack':209C,264C,313C 'authent':84C,139C,299C 'bind':195C 'bound':170C 'browser':134C 'bypass':85C 'caus':297C 'client':205C 'cms':77C 'collaps':153C 'comput':254C 'condit':88C,233C 'confirm':220C 'constant':249C 'cooki':140C,300C 'creat':123C 'cross':115C 'cross-domain':114C 'current':161C 'deriv':212C,245C 'discard':137C 'domain':109C,116C,184C,237C,243C,272C,286C 'domain-hash':242C 'due':98C 'empti':148C 'endpoint':287C 'fire':296C 'flow':221C 'forg':268C 'fulli':253C 'function':104C 'gain':315C 'gate':232C 'generat':112C 'get':143C 'handler':111C 'hash':244C 'hour':163C 'id':192C 'ident':214C 'ifram':102C,230C,295C 'includ':94C,321C 'independ':211C 'issu':303C 'land':130C 'languag':107C,285C 'language-domain':284C 'language-per-domain':106C 'legitim':290C 'log':330C 'logout':129C,219C,225C 'make':308C 'map':186C 'multilingu':76C 'nonc':124C,158C,251C 'page':131C 'paramet':273C 'per':108C,236C 'per-domain':235C 'plugin':78C 'possibl':310C 'process':101C,328C 'public':248C 'race':87C,334C 'rather':165C 'request':103C,204C,231C 'return':146C 'second':258C 'secondari':283C 'secret':171C 'session':144C 'sha256':181C 'share':156C 'sign':118C,200C,278C,293C 'sign-in':117C 'sign-out':199C 'specif':198C 'sso':110C,126C,179C,183C,238C,250C,259C,270C 'start':239C 'status':280C 'store':174C 'string':149C 'submit':266C 'tick':164C 'timeout':260C 'token':120C,145C,152C,215C,271C 'transient':185C,240C 'trigger':217C 'unauthent':208C,263C,312C 'user':169C,180C,191C,277C,292C,320C 'user-bound':168C 'version':90C 'via':86C,121C 'victim':189C,306C 'vulner':82C 'window':261C,335C 'within':255C 'wordpress':80C,298C 'wp':122C,142C 'wp-login.php':223C 'wpml':75C,125C,178C,182C,269C,276C,291C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76877","severity":null,"published_at":"2026-11-10T07:16:52+00:00","modified_at":"2026-11-10T07:16:52+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","fetched_at":"2026-11-10T07:20:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}