---
id: "CVE-2026-76877"
page: "https://infrastack.ai/live/CVE-2026-76877"
kind: "vulnerability"
aliases: ["CVE-2026-76877"]
title: "WPML plugin: a logout race lets attackers log in as other users"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpml"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-10T07:16:52+00:00"
first_seen_at: "2026-11-10T07:20:33+00:00"
updated_at: "2026-11-10T07:21:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76877", "first_seen_at": "2026-11-10T07:20:33+00:00"}]
exploit_sources: []
---

# WPML plugin: a logout race lets attackers log in as other users

Link for people: https://infrastack.ai/live/CVE-2026-76877 (this .md is for agents)

The WPML Multilingual CMS plugin for WordPress, up to and including 4.9.7, derives a predictable single-sign-on token during logout. An unauthenticated attacker can forge the token within a 60-second window and get WordPress login cookies issued for a user who is logging out, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPML version in the WordPress plugin list or `wp plugin get sitepress-multilingual-cms --field=version` if WP-CLI is available
- Confirm whether the multi-domain language-per-domain SSO feature is in use; the sources do not say how to test it

## Fix

- WPML up to and including `4.9.7` is affected; the sources do not state a fixed version

## Timeline

- 2026-11-10T07:20:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76877

## From the sources

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_