CVE-2026-3155

The CVE refers to the OneSignal – Web Push Notifications plugin for WordPress, vulnerable to an authorization bypass through versions up to 3.8.0 caused by improper verification of user authorization. This enables authenticated attackers with subscriber-level access and above to delete OneSignal ...