Critical Authentication Bypass in XTemos Basel Post Types Plugin for WordPress

## Overview The Basel Post Types plugin for WordPress has a critical vulnerability, CVE-2026-89324. This affects all versions up to and including 1.18. The flaw allows unauthenticated attackers to bypass authentication and gain access to user accounts. ## Technical Details The vulnerability stems from a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT within the BASEL_Auth::get_config() method. This error causes PHP to evaluate the constant's value instead of its name. As a result, the authentication check fails, defaulting to a static hardcoded salt that is publicly visible in the theme source code. This salt, 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O, allows attackers to compute a valid Opauth signature offline. They can then submit a forged callback to the unauthenticated init hook endpoint processed by register_or_login. Exploitation requires WooCommerce to be active and at least one Basel social-login provider configured with valid app_id and app_secret in the theme settings. ## Impact Attackers can authenticate as any existing WordPress user, including administrators. This bypasses password verification, multi-factor authentication, and ownership checks. A successful attack results in the attacker receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). ## Mitigation Defenders should update the Basel Post Types plugin to version 1.19 immediately. Regularly review and monitor plugin settings, especially for social-login configurations. Disable unused plugins and consider implementing additional security measures, such as web application firewalls, to mitigate potential exploitation.