OneSignal Web Push Notifications WordPress Plugin Authorization Bypass Vulnerability Allowing Post Metadata Deletion

A vulnerability exists in the OneSignal – Web Push Notifications plugin for WordPress, in versions through 3.8.0, allowing authorization bypass. The plugin fails to properly verify user authorization for certain actions, enabling authenticated attackers with subscriber-level access or higher to delete OneSignal metadata from arbitrary posts.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of OneSignal metadata from posts, which could disrupt notification delivery or post management.

Remediation

Users can update to version 3.8.1 or a newer patched version to address this vulnerability.