Basel Post Types: critical auth bypass in WordPress

What it is and who is affectedCVE-2026-89324 is an authentication bypass affecting the Basel Post Types plugin for WordPress, in all versions up to an...

What it is and who is affected

CVE-2026-89324 is an authentication bypass affecting the Basel Post Types plugin for WordPress, in all versions up to and including 1.18. It was published in the National Vulnerability Database (NVD) of NIST on 10 November 2026 and carries a CVSS 3.1 score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The underlying weakness is classified as CWE-287, improper authentication.

The root cause is a coding error rather than a design flaw: a missing pair of quotes in the defined() check for SECURE_AUTH_SALT inside BASEL_Auth::get_config() makes PHP evaluate the constant's value instead of its name. The check therefore always fails and the code falls back permanently to a static, hardcoded salt that is publicly visible in the theme source code. Because that salt is fixed and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged callback to the unauthenticated init hook endpoint handled by register_or_login. The result: anyone can authenticate as any existing WordPress user, administrators included, without any password, multi-factor authentication or ownership check, and receive a fully authenticated session cookie.

Two conditions must be met for exploitation. WooCommerce has to be active, and at least one Basel social-login provider (Facebook, Google or VKontakte) must be configured with a valid app_id and app_secret in the theme settings. This profile is common among online shops built on the Basel ecommerce theme, which is exactly the kind of stack used by many small and mid-sized retailers in Barcelona, Lleida, Tarragona and Girona.

How urgent is it?

As of publication, CVE-2026-89324 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record of it being exploited in the wild. That does not make it a low priority. A critical, unauthenticated, remotely reachable bypass with a known static secret is a straightforward target once the details are public, and the payoff is full administrative access to a shop that handles customer data and payments.

Note also what the flaw defeats: password policies, multi-factor authentication and account ownership checks are all skipped in one step. Any assumption that MFA protects the administrator account does not hold here.

What to do today

Check whether you use it. Confirm whether the Basel Post Types plugin is installed and, if so, which version. Anything at or below 1.18 is in scope.
Apply the fix from the vendor. Follow the guidance in the official notice for the plugin and the theme, and update to whatever version the vendor indicates as corrected. Do not guess a version number; the NVD entry does not state one.
Reduce the attack surface in the meantime. If the social-login providers are not essential, disable them and remove the stored app_id and app_secret, since exploitation requires a configured provider. Deactivating the plugin entirely is the safest interim measure if you cannot patch immediately.
Look for signs of intrusion. Review WordPress users and recent administrator sessions, audit logs for requests to the init endpoint carrying an opauth callback parameter, and check for unexpected changes to users, roles, plugins or theme files. A forged callback tied to a known account email is the pattern to hunt for.
Rotate what may be exposed. If you suspect a session was forged, invalidate sessions and reset the salts and keys in wp-config.php, then review the credentials of any account that could have been impersonated.

How a cybersecurity team can help

For a small shop or a lean IT department, the hard part is rarely reading the advisory; it is knowing what is actually installed across staging, production and that forgotten copy from two years ago, and then proving it has been fixed. This is where an external team earns its keep: an inventory of plugins, themes and versions, a pentest that tests whether an authentication bypass is genuinely reachable from the internet, and hardening of the server and the WordPress installation so that a single bad line of PHP does not hand over the shop.

ALMC's cybersecurity work for companies covers security audits and pentesting, server hardening, monitoring and incident response, ongoing maintenance and updating of WordPress, PrestaShop and Joomla, and repair of websites that have already been compromised. In cases like CVE-2026-89324, the useful sequence is to confirm exposure, close it following the vendor's notice, and then check calmly whether anyone got in before the door was shut. For an ecommerce business in Catalonia, that combination of patch discipline and intrusion review is what keeps a critical CVSS score from turning into a customer data breach under GDPR.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.