CVE-2025-13950 describes a missing authorization vulnerability (CWE-862) in the OneSignal – Web Push Notifications plugin for WordPress, versions up to and including 3.6.1. The plugin processes POST requests to update settings without verifying user permissions or nonces, enabling unauthenticated attackers to overwrite sensitive configuration data such as the OneSignal App ID, REST API key, and notification behavior. This could allow attackers to manipulate the plugin's behavior or potentially interfere with push notification delivery. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with an attack vector of network, no privileges required, and no user interaction needed. No patch or vendor advisory is currently provided.

An attacker can modify critical plugin settings without authentication, including the OneSignal App ID and REST API key. This unauthorized modification can impact the integrity of push notification configurations, potentially disrupting notification delivery or enabling further malicious actions through manipulated notification behavior. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress admin interface and consider disabling the plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.