CVE-2025-13950

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13950", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T09:44:06.039Z", "datePublished": "2025-12-15T14:25:12.695Z", "dateUpdated": "2026-04-08T17:24:36.767Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:36.767Z"}, "affected": [{"vendor": "onesignal", "product": "OneSignal \u2013 Web Push Notifications", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The OneSignal \u2013 Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests."}], "title": "OneSignal \u2013 Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve"}, {"url": "https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-11-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-24T14:16:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T02:15:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:24:43.703594Z", "id": "CVE-2025-13950", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:32:33.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13950", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:24:43.703594Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:24:44.726Z"}}], "cna": {"title": "OneSignal \u2013 Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "onesignal", "product": "OneSignal \u2013 Web Push Notifications", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-24T14:16:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T02:15:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve"}, {"url": "https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files"}], "descriptions": [{"lang": "en", "value": "The OneSignal \u2013 Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:36.767Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13950", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:36.767Z", "dateReserved": "2025-12-03T09:44:06.039Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-15T14:25:12.695Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OneSignal \u2013 Web Push Notifications", "vendor": "onesignal", "versions": [{"lessThanOrEqual": "3.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The OneSignal \u2013 Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests."}, {"lang": "es", "value": "El plugin OneSignal - Web Push Notifications para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en la funcionalidad de manejo de ajustes en todas las versiones hasta la 3.6.1, inclusive. Esto se debe a que el plugin procesa solicitudes POST sin verificar las capacidades del usuario o los nonces. Esto hace posible que atacantes no autenticados sobrescriban el ID de aplicaci\u00f3n de OneSignal, la clave de la API REST y el comportamiento de las notificaciones a trav\u00e9s de solicitudes POST directas."}], "id": "CVE-2025-13950", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13950", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:24:43.703594Z", "version": "2.0.3"}}]}, "published": "2025-12-15T15:15:48.810", "references": [{"source": "security@wordfence.com", "url": "https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:24:04.922513+00:00", "value": {"mitigation_remediation": ["Upgrade the OneSignal \u2013 Web Push Notifications plugin to a version that implements proper capability checks (any release newer than 3.6.1).", "Verify that the plugin\u2019s settings endpoint no longer accepts unauthenticated POST requests by testing or inspecting the plugin\u2019s code after the upgrade.", "After updating, audit and, if necessary, reset the OneSignal App ID, REST API key, and notification settings to ensure they have not been tampered with."], "summary": {"action": "Update Plugin", "impact": "Unauthorized configuration change"}, "threat_synthesis": {"affected_systems": "All WordPress installations using the OneSignal \u2013 Web Push Notifications plugin, including every version up to and including 3.6.1. The affected product is the OneSignal \u2013 Web Push Notifications plugin for WordPress, as supplied by OneSignal.", "description_and_impact": "The vulnerability arises from a missing capability check in the OneSignal \u2013 Web Push Notifications WordPress plugin. The plugin processes POST requests without verifying user permissions or nonces, allowing an unauthenticated attacker to overwrite critical settings such as the OneSignal App ID, the REST API key, and the notification behavior. This flaw compromises the integrity of the plugin configuration and may expose sensitive credentials or alter how notifications are sent, potentially facilitating phishing or data exfiltration attacks.", "risk_and_exploitability": "The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated: an attacker can send crafted HTTP POST requests to the plugin\u2019s settings endpoint, bypassing authentication checks and changing configuration data. The consequence is a compromise of configuration integrity and potential exposure of API credentials, which can be leveraged for further attacks such as unauthorized notification delivery or credential theft."}}}}, "created": "2025-12-15T21:33:25.277589+00:00", "updated": "2026-04-20T21:30:18.576450+00:00", "vendors": ["onesignal", "onesignal$PRODUCT$web_push_notifications", "wordpress", "wordpress$PRODUCT$wordpress"]}