CVE-2026-89324 is a critical (CVSS 9.8) authentication bypass in the Basel Post Types plugin for WordPress, up to and including version 1.18, that lets unauthenticated attackers sign in as any existing user, including administrators.
What Is It
The flaw is a coding error in BASEL_Auth::get_config(). The defined() check for SECURE_AUTH_SALT is missing quotes, so PHP evaluates the constant's value instead of its name. As a result, the check fails in standard configurations, and the plugin falls back to a static, hardcoded salt that can be read in the publicly distributed theme source code.
Because the salt is known, an attacker can compute a valid Opauth signature offline. They can then send a forged ?opauth callback to the unauthenticated init hook endpoint, which register_or_login processes. The forged callback is tied to the email address of the target account, and the attacker receives a fully authenticated session cookie through wc_set_customer_auth_cookie().
NVD classifies the weakness as CWE-287 (Improper Authentication).
Why It Matters
- No credentials needed: the attacker can authenticate as any existing WordPress user, including administrators.
- Core login checks are skipped: according to the advisory, the attack bypasses password verification, multi-factor authentication and ownership checks enforced through the standard login flow. Protections applied outside that flow, such as server-level access controls, may still apply.
- Easy to exploit: the CVSS vector
AV:N/AC:L/PR:N/UI:Nmeans it works over the network, with low complexity, no privileges and no user interaction. Confidentiality, integrity and availability impact are all high. - Little target information is required: on a site that meets the exploitation conditions below, a target's email address is the main input needed to forge the callback.
The flaw has no CISA Known Exploited Vulnerabilities (KEV) entry, so the supplied data does not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: XTemos
- Product: Basel Post Types plugin for WordPress, distributed with the Basel Responsive eCommerce theme
- Affected versions: all versions up to and including 1.18
A site can only be exploited when both of these are true:
- WooCommerce is active.
- At least one Basel social-login provider (Facebook, Google or VKontakte) is set up with a valid
app_idandapp_secretin the theme settings.
Patch Status
The supplied NVD record does not name a fixed version, and there is no CISA KEV entry, so no federal remediation deadline or required action applies. Administrators running Basel Post Types 1.18 or earlier should check the vendor and Wordfence advisories for an updated release.
Until a fix is confirmed, sites that meet the exploitation conditions should consider disabling the Basel social-login providers to remove the precondition. Because a session forged with the flaw would look like a normal login, admins should also review administrator accounts and active sessions.