The vulnerability arises from a missing capability check in the OneSignal – Web Push Notifications WordPress plugin. The plugin processes POST requests without verifying user permissions or nonces, allowing an unauthenticated attacker to overwrite critical settings such as the OneSignal App ID, the REST API key, and the notification behavior. This flaw compromises the integrity of the plugin configuration and may expose sensitive credentials or alter how notifications are sent, potentially facilitating phishing or data exfiltration attacks.

All WordPress installations using the OneSignal – Web Push Notifications plugin, including every version up to and including 3.6.1. The affected product is the OneSignal – Web Push Notifications plugin for WordPress, as supplied by OneSignal.

The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated: an attacker can send crafted HTTP POST requests to the plugin’s settings endpoint, bypassing authentication checks and changing configuration data. The consequence is a compromise of configuration integrity and potential exposure of API credentials, which can be leveraged for further attacks such as unauthorized notification delivery or credential theft.