EUVD-2026-23219
GHSA-qw58-mhg6-q49h
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Missing authorization on a web endpoint is straightforward to exploit with no special conditions; AC:L more accurately reflects the flaw than the official AC:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The OneSignal - Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete OneSignal metadata for arbitrary posts.
AnalysisAI
Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.
Technical ContextAI
The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw where a plugin performs a sensitive action without first verifying the requesting user holds sufficient privilege to do so. The affected component is the OneSignal - Web Push Notifications WordPress plugin (CPE: cpe:2.3:a:onesignal:onesignal_-_web_push_notifications:*:*:*:*:*:*:*:*), which integrates the OneSignal push-notification service into WordPress sites by storing per-post metadata (notification IDs, sent-state flags, etc.). WordPress's subscriber role is the lowest authenticated role, normally restricted to reading content. The missing authorization check means the plugin's action handler does not validate whether the caller owns or has edit rights to the target post before permitting metadata deletion, violating the principle of least privilege at the plugin layer.
RemediationAI
The upstream fix has been committed to the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset/3501190. Update the OneSignal - Web Push Notifications plugin to the version immediately following 3.8.0 via the WordPress admin dashboard (Plugins → Updates) or WP-CLI (wp plugin update onesignal-free-web-push-notifications). The exact released patch version is not independently confirmed from the available data - verify the current version in the WordPress plugin directory before updating. If immediate updating is not possible, a compensating control is to remove or demote subscriber-level accounts that should not have any content-management capability, reducing the pool of users who could exploit the missing check. There is no indication that disabling specific plugin features mitigates the flaw without removing the plugin entirely.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today