CVE-2026-89324

Summary

The Basel Post Types WordPress plugin (≤1.18) contains a missing-quotes bug in a PHP `defined()` call for `SECURE_AUTH_SALT`, causing authentication bypass via a hardcoded, publicly exposed salt value. This allows unauthenticated attackers to forge valid Opauth callbacks and authenticate as any user—including admins—without credentials or MFA.

Exploitability

Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) configured with valid app credentials, but otherwise is trivial for remote attackers with no authentication.

Blast radius

Successful exploitation grants full administrative access to the WordPress site, enabling complete compromise of data, users, and infrastructure.

Detection

Defenders should monitor for unauthenticated POST requests to the Opauth callback endpoint (e.g., `/index.php?opauth`) containing forged signature parameters, especially when paired with `wc_set_customer_auth_cookie()` in server logs or application logs indicating session creation for unknown or high-privilege users without prior login attempts.

Prioritized remediation

Upgrade to Basel Post Types plugin version 1.19 or later; if unavailable, disable social login functionality and restrict access to the `/wp-login.php` and Opauth callback endpoints until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.