CVE-2025-13950
Unauthorized Data Modification in OneSignal WordPress Plugin Settings
Publication date: 2025-12-15
Last updated on: 2025-12-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onesignal | wordpress_plugin | 3.6.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the OneSignal – Web Push Notifications plugin for WordPress allows unauthenticated attackers to modify plugin settings without proper authorization. Specifically, due to missing capability checks and nonce verification on the settings handling functionality, attackers can send direct POST requests to overwrite critical data such as the OneSignal App ID, REST API key, and notification behavior. This happens because the plugin processes POST requests without verifying user capabilities or nonces, enabling unauthorized modification of data. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to change your OneSignal plugin settings without permission. This could lead to unauthorized control over your push notification system, such as sending malicious or unwanted notifications, disrupting your notification behavior, or compromising the integrity of your notification service. Since attackers can overwrite the App ID and API key, they might redirect notifications or manipulate the service in ways that could harm your users or your website's reputation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unauthorized POST requests to the OneSignal WordPress plugin settings endpoints that modify the OneSignal App ID, REST API key, or notification behavior without proper authentication. Since the vulnerability allows unauthenticated attackers to send POST requests without capability or nonce checks, you can detect suspicious POST requests targeting the plugin's settings URLs. Specific commands depend on your environment, but for example, using web server logs or network monitoring tools, you can grep for POST requests to URLs related to OneSignal settings. Example command on a Linux server with access logs: `grep 'POST' /var/log/apache2/access.log | grep 'onesignal'` or using `tcpdump` to capture HTTP POST traffic to your server and filter for OneSignal plugin endpoints. Additionally, checking for unexpected changes in the OneSignal plugin settings in the WordPress database or admin interface may indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the OneSignal WordPress plugin to a version that includes the security patch addressing CVE-2025-13950 (versions after 3.6.1). The patch enforces nonce verification and user capability checks to prevent unauthorized POST requests. If updating immediately is not possible, restrict access to the WordPress admin area and the plugin settings endpoints to trusted users only, and consider implementing web application firewall (WAF) rules to block unauthorized POST requests targeting OneSignal plugin settings. Additionally, monitor and audit plugin settings for unauthorized changes and ensure that only authorized users have the 'manage_options' capability. [1]