CVE-2026-89324
CriticalCVSS 9.8Summary
The Basel Post Types plugin for WordPress (versions up to and including 1.18) contains a coding error in its authentication logic that causes a hardcoded SECURE_AUTH_SALT value, publicly visible in the theme source, to be used permanently. Because the salt is static and known, an unauthenticated attacker can forge an Opauth signature offline and submit a crafted callback to authenticate as any existing WordPress user, including administrators. Exploitation requires WooCommerce to be active and a configured social-login provider (Facebook, Google, or VKontakte).
Risk Assessment
An attacker can take over an administrator account without knowing the password, bypassing multi-factor authentication and obtaining a fully authenticated session. This leads to complete compromise of the WordPress site.
Recommendation
Update the Basel Post Types plugin to a version later than 1.18 or disable it until a fix is available. Review logs for suspicious ?opauth requests and audit accounts for unauthorized changes.
Related vulnerabilities
- CVE-2026-64682Critical
In AstroBlocks (a CMS for Astro projects) prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role "owner" and obtain full administrative control of the CMS.
- CVE-2026-64678Critical
In the Nitrite (NO2) database prior to version 4.4.1, MVStoreUtils.openOrCreate() automatically detects a legacy v1 format and triggers a migration path that deserializes stored values via java.io.ObjectInputStream.readObject() without any class allowlist or ObjectInputFilter. Any Serializable class reachable on the embedding application's classpath can be instantiated, which is a precondition for remote code execution if a suitable gadget class (e.g. from commons-collections) is present.
- CVE-2026-64670Critical
In Waline versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, injecting it via v-html. When editing a comment, the editor is seeded with the raw, un-sanitized body, so an administrator who clicks Edit on an attacker's comment renders that raw HTML in their own session, leading to stored XSS and privilege escalation.
- CVE-2026-126542Critical
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
- CVE-2026-126261Critical
An improper authorization vulnerability in Fortinet FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 may allow an unauthenticated attacker able to reach the FGFM port to execute code or commands via crafted FGFM packets.
- CVE-2026-126187Critical
The react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages from 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1 are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value; applications without server-side React code or without a framework/bundler supporting React Server Components are not affected.
- CVE-2026-82391Critical
In the Zephyr HTTP server's HTTP/2 front-end, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter, overwriting the count of unprocessed bytes in the per-connection receive buffer. Serving any static file via an unauthenticated HTTP/2 GET caused client->data_len to be replaced with the file's on-disk size, leading to out-of-bounds reads and writes and memory corruption. The flaw affects applications registering a static filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y.
- CVE-2026-125883Critical
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
- CVE-2026-125881Critical
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
- CVE-2026-125298Critical
AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 incorrectly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to perform privileged actions. Fixed in version 9.2.41.
Original NVD description (English source)
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS