Critical Authentication Bypass in Basel Post Types Plugin (CVE-2026-89324)

What is Affected and How Serious is It?

The Basel Post Types plugin for WordPress, in all versions up to and including 1.18, is affected by a critical vulnerability identified as CVE-2026-89324. This flaw enables unauthenticated attackers to bypass all security measures, including password verification and multi-factor authentication, and gain administrator access to a WordPress site. The vulnerability stems from a coding error within the BASEL_Auth::get_config() function. This error causes a missing-quotes issue in the defined() call for SECURE_AUTH_SALT, leading PHP to evaluate the constant's value instead of its name. Consequently, the security check always fails, causing the system to revert to a static, hardcoded salt that is publicly visible in the theme's source code.

Because this salt is static and known, an attacker can compute a valid Opauth signature offline. They can then submit a forged ?opauth callback to the unauthenticated init hook endpoint, which is processed by register_or_login. This exploit path allows an attacker to authenticate as any existing WordPress user, including administrators, by submitting a forged callback tied to a known target account email address. The process bypasses all password verification, multi-factor authentication, and ownership checks, ultimately granting the attacker a fully authenticated session cookie.

Exploitation of CVE-2026-89324 is contingent on two conditions: first, the WooCommerce plugin must be active on the site, and second, at least one Basel social-login provider (Facebook, Google, or VKontakte) must be configured with valid app_id and app_secret credentials within the theme's settings. This vulnerability has a CVSS score of 9.8, categorizing it as critical and representing a high-impact threat to WordPress sites.

You can find more details on the National Vulnerability Database (NVD) here: https://nvd.nist.gov/vuln/detail/CVE-2026-89324.

Need it patched now? A senior engineer (20+ years in production PHP) applies the fix, updates safely and checks checkout, login and forms afterwards, within 24–48 hours, no meetings. One-time $99. Queue an emergency fix → · Want this handled every month? WordPress care plan →

How to Check if Your Site is Exposed

To determine if your WordPress site is vulnerable to CVE-2026-89324, you need to verify the version of the Basel Post Types plugin currently installed and check for specific configurations.

1. Version Check:

   • Log in to your WordPress admin dashboard.
   • Navigate to Plugins > Installed Plugins.
   • Locate the "Basel Post Types" plugin in the list.
   • Check the version number displayed. If it is 1.18 or earlier, your site is vulnerable.

2. Configuration Check:

   • While logged into your WordPress admin dashboard, navigate to the theme's options or settings panel. The exact location may vary depending on the Basel theme.
   • Look for sections related to "Social Login," "Social Connect," or specific provider settings (Facebook, Google, VKontakte).
   • Check if any social login providers are enabled and if App ID and App Secret values have been entered. If these fields are populated, your site is potentially exploitable if the plugin version is vulnerable.

3. Using WP-CLI (Advanced Users):

   • If you have SSH access to your server and WP-CLI installed, you can check the plugin version via the command line.
   • Navigate to your WordPress installation directory.
   • Run the command: wp plugin list --fields=name,version
   • Look for the basel-post-types entry and its associated version number.

4. Reviewing Logs (If Exploitation is Suspected):

   • While not a direct check for vulnerability, reviewing server access logs or WordPress security plugin logs might reveal suspicious activity, such as unexpected ?opauth callback requests or successful unauthorized logins, especially if you suspect an attempted or successful exploitation.

Immediate Mitigation if You Cannot Update Today

If immediate updating to a patched version of the Basel Post Types plugin is not feasible, taking the following steps can significantly reduce your risk:

1. Disable Configured Social Login Providers: The most effective immediate mitigation is to disable all configured social login providers within the Basel theme settings. This removes the requirement for a configured app_id and app_secret, which is necessary for exploitation.

   • Log in to your WordPress admin area.
   • Navigate to your theme's options/settings.
   • Locate the social login configuration section.
   • Disable or unconfigure each social login provider (Facebook, Google, VKontakte). Remove any entered App ID and App Secret values.
   • Save the changes.

2. Disable the Plugin (Last Resort): If disabling social logins is not possible or you want an extra layer of security, consider temporarily deactivating the Basel Post Types plugin. Be aware that this may affect the functionality of your website if the plugin provides essential post type functionalities beyond social login.

   • Log in to your WordPress admin area.
   • Go to Plugins > Installed Plugins.
   • Find the "Basel Post Types" plugin.
   • Click Deactivate.

How to Update Safely

Updating plugins on a live WordPress site should always be a controlled process to prevent unexpected issues and ensure smooth operation.

1. Backup Your Site: Before making any changes, create a full backup of your WordPress files and database. This is your safety net in case anything goes wrong during the update process. Use a reliable backup plugin or your hosting provider's backup tools.

2. Use a Staging Environment: If possible, perform the update on a staging site. A staging environment is a copy of your live site where you can test updates and configurations without affecting your production website. Many hosting providers offer staging site functionality.

3. Update the Basel Post Types Plugin:

   • Once you have a backup and ideally a staging environment ready, log in to your WordPress admin area.
   • Go to Dashboard > Updates.
   • Alternatively, go to Plugins > Installed Plugins.
   • Find the "Basel Post Types" plugin. If an update is available, you will see an option to "Update now."
   • Click "Update now" and wait for the process to complete.

4. Test Thoroughly: After the update, it is crucial to test your website thoroughly:

   • Login/Logout: Test logging in and out of your WordPress user accounts.
   • User Registration: If applicable, test the user registration process.
   • Social Login (if re-enabled): If you re-enable social login features after updating, test each configured provider to ensure they function correctly.
   • E-commerce Flow (if applicable): For e-commerce sites using WooCommerce, test the entire checkout process, from adding items to the cart to completing a purchase.
   • Frontend and Backend Functionality: Browse your website, check different pages, and ensure all core functionalities provided by the Basel theme and other plugins are working as expected.

5. Monitor: Keep an eye on your website's performance and logs for a few days after the update to catch any subtle issues.

Update Checklist

• Backup your WordPress site (files and database).
• If possible, create and use a staging environment for the update.
• Verify that the "Basel Post Types" plugin is updated to the latest available version.
• Test user login and logout functionality.
• Test user registration process.
• If social login is used, test all configured providers.
• For e-commerce sites, test the full checkout process.
• Browse the frontend and backend to ensure all website functionalities are working.
• Monitor the site for any unusual activity or errors post-update.