CVE-2026-76877 | WPML Multilingual CMS Plugin up to 4.9.7 on WordPress SSO wp-login.php process_iframe_request wpml_sso_token_domain race condition

A vulnerability was found in WPML Multilingual CMS Plugin up to 4.9.7 on WordPress. It has been declared as critical. Affected is the function process_iframe_request of the file wp-login.php of the component SSO Handler. Such manipulation of the argument wpml_sso_token_domain leads to race condition.

This vulnerability is documented as CVE-2026-76877. The attack can be executed remotely. There is not any exploit available.VulDB Recent EntriesRead More