CVE-2026-3155 is an authorization bypass vulnerability in the OneSignal – Web Push Notifications plugin for WordPress, affecting versions up to and including 3.8.0. The plugin fails to properly verify that a user is authorized to perform certain actions, enabling authenticated users with subscriber-level privileges or higher to delete OneSignal metadata associated with arbitrary posts. This vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

An authenticated user with subscriber-level access or higher can delete OneSignal metadata for arbitrary posts, potentially affecting the integrity of push notification data. There is no impact on confidentiality or availability. The overall impact is limited and classified as low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for unusual activity related to OneSignal metadata modifications.