Basel Post Types: authentication bypass (CVE-2026-89324)
In the Basel Post Types plugin for WordPress, a coding error in the defined() call for SECURE_AUTH_SALT makes the plugin always fall back to a hardcoded salt that is visible in the theme source code. An unauthenticated attacker can forge an ?opauth callback and log in as any user, including an administrator. CVSS 9.8.
Checked in Shield: no
Who is affected
All versions of Basel Post Types up to and including 1.18. Conditions: WooCommerce is active and at least one Basel social-login provider is enabled.
How to check
In the WordPress admin, open the Plugins page and check whether Basel Post Types is installed and which version it is. Then check whether WooCommerce is active and Basel social login is enabled.
How to fix
A fixed version is not disclosed yet. As a temporary measure, consider disabling the Basel social-login providers or deactivating the plugin, and watch for an update from the vendor.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and whether the flaw is exploited in the wild are not disclosed yet. Source: NVD.
