Basel Post Types WordPress plugin: Authentication bypass via forged Opauth callback
Summary
The Basel Post Types plugin for WordPress up to and including version 1.18 uses a hardcoded fallback salt because of a coding error in its configuration check. An unauthenticated attacker can compute a valid Opauth signature offline and forge a login callback for any existing WordPress account, including administrators. The attack requires WooCommerce to be active and at least one social-login provider (Facebook, Google or VKontakte) configured with app credentials in the theme settings.
Affected
- Basel Post Types plugin up to and including version 1.18
- Exploitation requires WooCommerce to be active
- Exploitation requires a configured Facebook, Google or VKontakte social-login provider
Fixed in
Unknown. No fixed version has been confirmed by the vendor.
Workaround
- Disable social-login features of the Basel theme or remove the provider app credentials (app_id and app_secret) until a vendor fix is available; effectiveness not verified
- Disable the Basel Post Types plugin if it is not essential
- No vendor-confirmed workaround exists
Exploitation
- Attack vector: network, no authentication, low complexity (CVSS 3.1: 9.8, critical)
- Known exploitation in the wild: Unknown. Not known to be exploited according to a third-party source.
- Public proof-of-concept: Unknown. None found in searches.
Our recommendation
- Inventory WordPress sites using the Basel theme or the Basel Post Types plugin and check the installed plugin version
- Where social login is enabled, disable it or remove the provider credentials until a vendor fix is confirmed
- Contact XTemos for a fix date and advisory and monitor the vendor changelog and the Wordfence record
- Review administrator accounts and recent logins on exposed sites for unexpected activity
- Re-check exploitation and proof-of-concept status in the coming days
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
im0xfay/CVE-2026-89324
Research sources
- Wordfence threat intelligence record www.wordfence.com
- CVE Record CVE-2026-89324 www.cve.org
- ThemeForest Basel product page themeforest.net
- OffSeq threat radar entry radar.offseq.com
- XTemos Basel changelog xtemos.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:32.
Original description (NVD)
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.