Basel Post Types WordPress Plugin Authentication Bypass Vulnerability

The Basel Post Types plugin for WordPress is vulnerable to an authentication bypass in all versions up to and including 1.18.

A missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to a static hardcoded salt that is publicly visible in the theme source code. Because the salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login.

This lets unauthenticated attackers authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address. It bypasses password verification, multi-factor authentication, and ownership checks, and results in a fully authenticated session cookie via wc_set_customer_auth_cookie().

• Affects all versions up to and including 1.18
• Requires WooCommerce to be active
• Requires at least one Basel social-login provider (Facebook, Google, or VKontakte) configured with a valid app_id and app_secret