{"id":"EM-20261110-NJOA","url":"https://cyber.eventmonitor.net/incident/EM-20261110-NJOA/critical-basel-post-types-vulnerability-cve-2026-89324/","type":"cve","title":"Critical Basel Post Types Vulnerability (CVE-2026-89324)","subtitle":"CVE-2026-89324","subject":"CVE-2026-89324","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-10T22:21:14.003Z","firstSignal":"2026-11-10T00:00:00.000Z","lastSignal":"2026-11-10T22:21:14.003Z","updated":"2026-11-10T22:24:45.599Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T22:21:14.003Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-10T22:21:14.003Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T00:00:00.000Z","what":"First signal: C30 VulnCheck KEV"},{"at":"2026-11-10T22:21:14.003Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261110-NJOA created."},{"at":"2026-11-10T22:21:14.003Z","what":"Severity raised to Critical by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-10T22:21:14.003Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T22:21:14.003Z","detail":"CVSS 9.8"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-89324 known exploited (VulnCheck KEV): Basel Post Types","text":null,"url":"https://vulncheck.com/browse/cve/CVE-2026-89324"},{"at":"2026-11-10T22:21:14.003Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-89324 (CVSS 9.8)","text":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89324"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T22:21:14.003","score":9.8,"severity":"CRITICAL","desc":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the…","product":"","seen":1794349485599},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}