The Basel Post Types plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.18. This flaw arises from a coding error that causes a static, publicly visible salt to be used for authentication, allowing attackers to forge valid authentication callbacks. Exploitation requires WooCommerce and a configured Basel social-login provider. Successful exploitation enables attackers to authenticate as any WordPress user without password or multi-factor authentication checks.