CVE-2026-3155: OneSignal WordPress Auth Bypass Flaw

CVE-2026-3155 Overview

The OneSignal – Web Push Notifications plugin for WordPress contains an authorization bypass vulnerability in versions up to and including 3.8.0. The vulnerability stems from the plugin's failure to properly verify that a user is authorized to perform specific actions. This security flaw allows authenticated attackers with subscriber-level access or above to delete OneSignal metadata for arbitrary posts, potentially disrupting push notification functionality across affected WordPress sites.

Critical Impact

Authenticated attackers with minimal privileges (subscriber-level) can delete OneSignal metadata for any post on the WordPress site, potentially disrupting push notification campaigns and causing data integrity issues.

Affected Products

• OneSignal – Web Push Notifications plugin for WordPress versions up to and including 3.8.0

Discovery Timeline

• 2026-04-16 - CVE-2026-3155 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-3155

Vulnerability Analysis

This authorization bypass vulnerability (CWE-862: Missing Authorization) occurs because the OneSignal plugin does not implement proper capability checks before allowing users to perform sensitive operations. The plugin exposes functionality that allows the deletion of OneSignal metadata associated with WordPress posts, but fails to verify whether the requesting user has appropriate permissions to modify that specific content.

In WordPress, subscribers represent the lowest level of authenticated user roles with minimal default capabilities. However, due to the missing authorization check, these low-privilege users can invoke the metadata deletion functionality as if they were administrators or editors with legitimate access to modify post data.

The impact of this vulnerability includes potential disruption to push notification delivery, as the deleted metadata may contain configuration data necessary for OneSignal to properly target notifications to specific posts or content updates.

Root Cause

The root cause of this vulnerability is the absence of proper authorization verification in the plugin's metadata deletion functionality. The affected code path does not utilize WordPress capability checks (such as current_user_can()) to verify that the authenticated user has appropriate permissions to delete metadata for the target post. This represents a classic broken access control vulnerability where authentication is verified but authorization is not properly enforced.

Attack Vector

The attack requires network access and an authenticated session with at least subscriber-level privileges. An attacker would need to:

1. Obtain valid credentials for a WordPress account with subscriber-level access or higher on the target site
2. Identify posts with OneSignal metadata
3. Send crafted requests to the vulnerable endpoint to delete OneSignal metadata for arbitrary posts

The vulnerability has a high attack complexity as it requires specific conditions to be met for successful exploitation, including valid authentication and knowledge of the target post structure.

The vulnerability allows attackers to delete OneSignal metadata through the plugin's AJAX handlers or REST API endpoints that lack proper authorization checks. Technical details are available in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3155

Indicators of Compromise

• Unexpected deletion of OneSignal post metadata across multiple posts
• Unusual activity from subscriber-level accounts accessing OneSignal plugin endpoints
• Audit log entries showing metadata modifications by users without appropriate content editing privileges
• Missing push notification configurations on posts that previously had them configured

Detection Strategies

• Monitor WordPress activity logs for metadata deletion events initiated by low-privilege users
• Implement application-level logging for OneSignal plugin operations
• Review access patterns to plugin AJAX endpoints for anomalous behavior from subscriber accounts
• Enable WordPress debug logging to capture unauthorized access attempts

Monitoring Recommendations

• Configure alerts for bulk metadata changes across posts
• Monitor for unusual patterns of API requests to OneSignal-related endpoints
• Implement user behavior analytics to detect privilege abuse from subscriber accounts
• Regularly audit OneSignal metadata integrity across WordPress posts

How to Mitigate CVE-2026-3155

Immediate Actions Required

• Update the OneSignal – Web Push Notifications plugin to a version newer than 3.8.0
• Review WordPress user accounts and remove unnecessary subscriber access
• Audit recent activity logs for signs of exploitation
• Temporarily restrict plugin access to administrators only if immediate patching is not possible

Patch Information

A security patch addressing this authorization bypass vulnerability is available. The fix can be reviewed in the WordPress Plugin Changeset. Site administrators should update to the latest version of the OneSignal plugin through the WordPress plugin management interface.

Additional technical details and vulnerability analysis are available from the Wordfence Vulnerability Report.

Workarounds

• Restrict subscriber account creation until the plugin is updated
• Implement a Web Application Firewall (WAF) rule to block unauthorized requests to OneSignal plugin endpoints
• Use WordPress security plugins to add additional capability checks at the application layer
• Consider temporarily disabling the OneSignal plugin if push notifications are not critical to operations

# Configuration example
# Temporarily disable OneSignal plugin via WP-CLI until patched
wp plugin deactivate onesignal-free-web-push-notifications

# Update to the latest patched version
wp plugin update onesignal-free-web-push-notifications

# Re-enable the plugin after updating
wp plugin activate onesignal-free-web-push-notifications