CVE-2026-3155

A security flaw exists in versions of the OneSignal – Web Push Notifications WordPress plugin up through 3.8.0, where insufficient authentication checks allow users with subscriber-level permissions or higher to erase OneSignal data associated with any post. This vulnerability arises from inadequate verification of user authorization before allowing certain actions. As a result, an authenticated attacker can exploit this weakness to delete arbitrary post metadata.

Based on public CVE data (MITRE/NVD).