CVE-2026-15162
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Object Sync for Salesforce plugin for WordPress is vulnerable to unauthenticated SQL injection via the wordpress_object_type parameter in the REST route /wp-json/object-sync-for-salesforce/push/. The can_process() function only checks the HTTP method, and the parameter value is directly concatenated into a SQL query. Attackers can inject additional SQL queries, allowing extraction of sensitive data such as password hashes.
Risk Assessment
An unauthenticated attacker can access the database, including user password hashes, potentially leading to account takeover.
Recommendation
Update the Object Sync for Salesforce plugin to the latest patched version. Restrict access to the REST route to trusted users only.
Original NVD description (English source)
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.