What’s Vulnerable › Vulnerabilities

CVE-2025-13950: OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-15 · updated 2026-10-07
• Weakness: CWE-862

Description

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests.

Affected products

• OneSignal – Web Push Notifications: through 3.6.1

References

• https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve

Get alerted when CVE-2025-13950 or the next vulnerability affects your stack