Basel Post Types up to version 1.18 ships a hardcoded fallback signing salt, and that is enough for an unauthenticated attacker to forge a social-login callback and walk out with a logged-in session as any user on the site, administrators included.
What happened
The flaw is CVE-2026-89324, published by Wordfence on 10 November 2026 with a CVSS score of 9.8. Inside BASEL_Auth::get_config() a missing pair of quotes in the defined() check for SECURE_AUTH_SALT makes PHP evaluate the constant's value rather than its name. The check therefore always fails, and the code falls back to a static salt that is written in plain sight in the theme source.
Because that salt never changes between installations, an attacker can compute a valid Opauth signature offline and post a forged opauth callback to the plugin's unauthenticated init hook. The handler tied to register_or_login then issues a fully authenticated session cookie through wc_set_customer_auth_cookie(), with no password check, no multi-factor prompt and no ownership verification.
Two conditions have to be met. WooCommerce must be active, and at least one Basel social-login provider (Facebook, Google or VKontakte) must be configured with a valid app_id and app_secret in the theme settings. Version 1.19 fixes it.
Who is affected
- WordPress sites running the Basel theme with Basel Post Types 1.18 or earlier installed.
- Those sites must also have WooCommerce active.
- And at least one Basel social-login provider must be configured with real credentials.
- Sites without WooCommerce, or with no social login configured, do not meet the documented attack path.
What to do now
Update Basel Post Types to 1.19 or later, and check whether social login was ever switched on in the first place.
- Update to 1.19 from Dashboard > Plugins. The theme bundle carries its own copy, so re-check the version after any theme update.
- If social login is not a business requirement, clear the provider credentials from the theme settings as well as patching.
- Audit wp_users for administrator accounts nobody recognises, and review login records for sessions that started without a password or MFA prompt.
- If you cannot patch immediately, deactivate the plugin rather than leaving it active.
What this means for South African businesses
Basel is a ThemeForest e-commerce theme, and small South African online stores are exactly the profile that buys a theme, adds WooCommerce and switches on Google sign-in to speed up checkout. The configuration that makes this exploitable is the configuration the theme's own setup flow encourages.
My judgement is that the risk here is not defacement. An attacker who fingerprints a Basel store can hold the administrator account with no user interaction at all, which is the position from which payment-skimming scripts and supplier-invoice fraud get planted.
Wordfence published the technical detail and the fixed version in its advisory at the Wordfence vulnerability record.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.