CVE-2026-89324
validatedZero produced an exploit or a check.description
Basel Post Types versions through 1.18 can allow an unauthenticated party to obtain a session for an existing WordPress account, potentially including administrative accounts. Exposure requires WooCommerce and an enabled, configured Basel social-login provider.
mitigation
Disable Basel social-login providers or deactivate the Basel Post Types plugin until a corrected release is available. Restrict public access to affected sites and review account sessions and administrator activity.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-10vulncheck_kev: trigger signal, started the run
- 2026-11-10 00:00Z
- 2026-11-10 15:11Z
- 2026-11-10 21:28Zcve.org record for CVE-2026-89324
this entry in the feed
GET /api/v1/feed/CVE-2026-89324
{ "etk_id": "ETK-2026-4062", "cve_id": "CVE-2026-89324", "display_id": "CVE-2026-89324", "ghsa_id": null, "euvd_id": "EUVD-2026-122966", "status": "published", "anchor_state": "anchored", "title": "Authentication bypass in Basel Post Types", "summary": "Basel Post Types versions through 1.18 can allow an unauthenticated party to obtain a session for an existing WordPress account, potentially including administrative accounts. Exposure requires WooCommerce and an enabled, configured Basel social-login provider.", "mitigation": "Disable Basel social-login providers or deactivate the Basel Post Types plugin until a corrected release is available. Restrict public access to affected sites and review account sessions and administrator activity.", "vendor": "XTemos", "product": "Basel Post Types", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.18" ], "ecosystem": null, "fixed_versions": [], "package_name": "Basel Post Types", "purl": null } ], "cwes": null, "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.01089805, "t0_at": "2026-11-10T21:28:25.595000+00:00", "signals": { "check": { "at": "2026-11-10T15:11:41.842697+00:00", "days": -0.26161750350694446, "is_lower_bound": false, "measured_at": "2026-11-10T21:28:25.595000+00:00", "url": null }, "kev": { "at": "2026-11-10T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-10T21:28:25.595000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-89324" }, "trigger_signal": { "at": "2026-11-10T00:00:00+00:00", "days": -0.8947406828703703, "is_lower_bound": false, "measured_at": "2026-11-10T21:28:25.595000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-89324" } } }
Anchor corroborated by the cve.org commit 86f4630becc0.
published 2026-11-10 15:11Z
last change 2026-11-11 00:21Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.