0Xwackydawg

An authentication bypass exists due to a missing-quotes coding error in the `defined()` call for `SECURE AUTH SALT` within the `BASEL Auth::get config()` function. This error causes PHP to evaluate the constant's value instead of its name, leading the system to fall back to a static, hardcoded salt that is publicly visible in the theme source code. An unauthenticated attacker can use this known salt to compute a valid Opauth signature offline and submit a forged callback to the `register or login` endpoint. This allows the attacker to authenticate as any WordPress user, including administrators, bypassing password verification, multi-factor authentication, and ownership checks to receive an authenticated session cookie via `wc set customer auth cookie()`. This issue requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid `app id` and `app secret`.

An authentication bypass exists that allows for account takeover via the `qode membership check facebook user` AJAX action. The issue stems from a typographic error in the `qode membership login user from social network()` function, where the guard condition checks an undefined variable `$check social useqoder` instead of `$check social user`. This causes the `empty()` check to always return true, bypassing the Graph API token verification and allowing `wp set auth cookie()` to be executed without credential validation. Unauthenticated attackers can log in as any user, including administrators, by providing a known login name in the `response[email]` parameter. This process requires a `qode validate facebook login` nonce, which is publicly available on pages using the `[qode user login]` or `[qode user register]` shortcodes.