CVE-2026-89324

Name of the Vulnerable Software and Affected Versions Basel Post Types versions prior to 1.19

Description An authentication bypass exists due to a missing-quotes coding error in the defined() call for SECURE AUTH SALT within the BASEL Auth::get config() function. This error causes PHP to evaluate the constant's value instead of its name, leading the system to fall back to a static, hardcoded salt that is publicly visible in the theme source code. An unauthenticated attacker can use this known salt to compute a valid Opauth signature offline and submit a forged callback to the register or login endpoint. This allows the attacker to authenticate as any WordPress user, including administrators, bypassing password verification, multi-factor authentication, and ownership checks to receive an authenticated session cookie via wc set customer auth cookie(). This issue requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app id and app secret.

Recommendations Update Basel Post Types to version 1.19 or later.