CVE-2026-89324: Authentication Bypass Vulnerability in Basel Post Types Plugin for WordPress

Introduction

The CVE-2026-89324 vulnerability affects the Basel Post Types plugin for WordPress, allowing unauthenticated attackers to bypass authentication and access user accounts, including administrators.

What happened?

The plugin has an authentication bypass flaw due to a coding error that causes the authentication check to fail permanently. This occurs because the value of a constant is evaluated instead of its name, resulting in a security drop that allows the use of a static and known salt.

How the vulnerability works

The vulnerability lies in the way authentication is processed. When the plugin attempts to verify a user's authenticity, the coding flaw causes the check to not occur correctly, allowing an attacker to create a valid Opauth signature offline and submit it to an endpoint that processes authentication, thus bypassing all verification mechanisms, including multi-factor authentication.

What is the real impact?

The impact of this vulnerability is critical, as it allows unauthenticated attackers to authenticate as any existing WordPress user, including administrators. This can lead to account compromises, unauthorized access to sensitive data, and potentially site manipulation.

Which versions are affected?

• All versions up to 1.18

How to fix

1. Update the Basel Post Types plugin to the latest available version.
2. Check that the configuration of WooCommerce and social login providers is correct and secure.
3. Consider disabling the plugin until an official fix is available.

Mitigation while you update

While it is not possible to update, it is recommended to disable the Basel Post Types plugin and review user permissions to minimize the risk of unauthorized access.

Conclusion

The CVE-2026-89324 vulnerability poses a significant risk to all users of the Basel Post Types plugin. It is essential for WordPress site administrators to take immediate action to protect their installations.