The unpatched 8.1 session vulnerability in WPML

A vulnerability that bypasses authentication has surfaced in WPML, one of the most widely used multilingual plugins on WordPress sites. According to the Wordfence entry, the issue is tracked as CVE-2026-76877, affects version 4.9.7 and earlier, and has a CVSS score of 8.1. The bad part is this: even though the vulnerability is public, there’s no published patch yet.

The flaw waits for the victim to log out

The issue is in the session bridge WPML uses on sites that publish each language on a separate domain, specifically in the process_iframe_request function. On the logout page, the plugin generates a cross-domain login token with wp_create_nonce(‘wpml_sso’). But because the browser has already deleted the session cookies at that point, the function returns an empty string, and the token stops being a user-specific secret and turns into a shared value that anyone can calculate within a 12-hour window. The token is then matched to the victim’s user ID and written to temporary storage; there’s no binding that distinguishes which logout action or which client it belongs to.

All the attacker has to do is trigger the logout flow themselves at wp-login.php?action=logout and calculate the same token. Then, before the 60-second SSO window expires, they send the “logged in” state to the second language domain using the wpml_sso_token_domain parameter. Before the real logout iframe runs, WordPress issues a session cookie on behalf of the victim. In other words, the attack depends on the target actively logging out at that moment; that’s why the complexity is marked as “high” in the CVSS rating.

If the target is an admin account, the risk is serious

The affected version range is 4.9.7 and below. The flaw can target any logged-in user; if the victim is a site administrator, what the attacker gets is full control of the site. With that session, they can do everything from uploading themes and plugins to changing content and creating a new admin account. Restored old backups, sites that haven’t updated the plugin in years, and corporate sites running multiple language domains are the most fragile group in this picture.

Wordfence says the vulnerability only works when separate domains per language and the SSO bridge setup are enabled. On sites using subdirectory-based multilingual setup on a single domain, this code path doesn’t come into play. Even so, any installation running version 4.9.7 or below should check the plugin settings.

No patch yet, but there are temporary mitigations

Wordfence’s entry marks the plugin as “unpatched”; the recommendation is to take action based on your risk tolerance and, if necessary, remove the plugin and look for an alternative. Practical steps are:

• Temporarily disable the plugin. If the site is published in a single language, this may be a permanent solution.
• If a multilingual setup is required, disable the separate domain per language setting and the cross-domain session bridge.
• Change admin account passwords and terminate active sessions; that way, any possible token capture becomes useless.
• Check login logs for admin sessions coming from IP addresses you don’t recognize.
• Follow announcements on wpml.org; apply the fixed release as soon as it becomes available.

On the WordPress side, plugin-driven authentication flaws have been coming one after another in recent months. The 9.8-rated flaw in WooCommerce plugins and the account takeover issue in LatePoint followed the same pattern. After news like this, the quickest win is removing unused plugins and keeping track of the versions of the ones you do use.

Source: Wordfence · CVE-2026-76877