The WPML Multilingual CMS plugin for WordPress versions up to and including 4.9.7 contains an authentication bypass vulnerability due to a race condition in its single sign-on (SSO) mechanism. This flaw allows unauthenticated attackers to forge authentication tokens during the victim's logout process, potentially gaining unauthorized access to user accounts, including administrators. The vulnerability arises because the cross-domain sign-in token can be derived without user authentication and is not properly bound to the logout action or client, enabling token reuse within a short time window.