Onesignal Web Push Notifications
Monthly
Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.
Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.