CVE-2025-13950: 
WordPress vulnerability analysis and mitigation

CVE-2025-13950 is a Missing Authorization vulnerability in the OneSignal – Web Push Notifications plugin for WordPress, allowing unauthenticated attackers to overwrite plugin settings including the OneSignal App ID, REST API key, and notification behavior. All plugin versions up to and including 3.6.1 are affected. The vulnerability was disclosed on December 15, 2025, with the CVE record received from Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, GitHub PR #387).

The root cause is CWE-862 (Missing Authorization): the plugin's settings handling functionality processed POST requests without verifying user capabilities or WordPress nonces, meaning any unauthenticated HTTP POST request could trigger settings changes (Wordfence). Specifically, the onesignal-admin.php file handled POST submissions inline without calling check_admin_referer() or current_user_can(), and onesignal-notification.php similarly lacked nonce verification before processing notification trigger data from $_POST. The fix (merged December 2, 2025, prior to public disclosure) refactored settings saving into a dedicated onesignal_handle_settings_save() function hooked to admin_init, adding both check_admin_referer('onesignal_v3_save_settings', 'onesignal_v3_settings_nonce') and current_user_can('manage_options') checks (GitHub PR #387).

Successful exploitation allows an unauthenticated attacker to overwrite the site's OneSignal App ID and REST API key, effectively hijacking the push notification channel to send arbitrary notifications to all subscribers, redirect notification traffic to an attacker-controlled OneSignal account, or disable legitimate notifications entirely. While confidentiality and availability are not directly impacted (CVSS scores these as None), the integrity impact enables abuse of subscriber trust, potential phishing via push notifications, and disruption of site communication workflows (Wordfence).

1. Reconnaissance: Identify WordPress sites running the OneSignal – Web Push Notifications plugin version ≤ 3.6.1 using tools like WPScan, Shodan, or by checking the plugin's readme.txt at https://target.com/wp-content/plugins/onesignal-free-web-push-notifications/readme.txt.
2. Craft malicious POST request: Prepare an HTTP POST request targeting the WordPress admin settings endpoint (e.g., https://target.com/wp-admin/admin.php?page=onesignal-push) with parameters including submit=Save+Settings, onesignal_app_id=<attacker_app_id>, and onesignal_rest_api_key=<attacker_api_key>.
3. Send unauthenticated request: Submit the POST request directly without any authentication cookies or nonce tokens, exploiting the missing capability and nonce checks in the vulnerable plugin code.
4. Verify takeover: Confirm that the site's OneSignal settings now point to the attacker's App ID and REST API key by observing the plugin's JavaScript configuration loaded on the site's frontend.
5. Abuse push channel: Use the attacker-controlled OneSignal account to send arbitrary push notifications to all site subscribers, potentially delivering phishing content or malicious URLs (GitHub PR #387, Wordfence).

• Network: Unexpected unauthenticated POST requests to /wp-admin/admin.php?page=onesignal-push or similar OneSignal admin pages from external IP addresses without valid session cookies.
• Logs: WordPress access logs showing POST requests to OneSignal admin pages from unauthenticated sessions (no wordpress_logged_in_* cookie); web server logs with 200 responses to these requests.
• Database: Changes to the OneSignalWPSetting option in the WordPress wp_options table, particularly modifications to app_id or app_rest_api_key fields to unrecognized values.
• Behavioral: Push notifications being sent to site subscribers from an unrecognized OneSignal App ID; site subscribers receiving unexpected or unauthorized push notifications.

Update the OneSignal – Web Push Notifications plugin to version 3.6.2 or later, which includes the fix merged on December 2, 2025 (PR #387) adding proper nonce verification and capability checks (GitHub PR #387). As an interim workaround, site administrators can temporarily deactivate the plugin or restrict access to WordPress admin endpoints via server-level rules (e.g., IP allowlisting for /wp-admin/). After patching, verify the OneSignal App ID and REST API key in plugin settings to ensure they have not been tampered with.

Wordfence reported the vulnerability and assigned the CVE, with the fix already merged into the plugin repository before public disclosure on December 15, 2025 (Wordfence). Sucuri included it in their December 2025 vulnerability patch roundup (Sucuri Blog). Community reaction has been limited given the medium severity rating and lack of active exploitation.