CVE-2026-15162

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14

Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process() permission callback only verifies the HTTP method and fails to check for user capabilities or nonces. The wordpress object type parameter is concatenated directly into a SQL query within the class-object-sync-sf-wordpress.php file and executed via $wpdb->get results() without using $wpdb->prepare(). Since REST body parameters are not magic-quoted, an attacker can inject arbitrary SQL, including time-based blind queries, to extract sensitive data such as password hashes from the database. This exploitation requires only a valid wordpress id and does not require authentication or a Salesforce connection.

Recommendations Update Object Sync for Salesforce to version 2.2.14 or later. As a temporary workaround, restrict access to the /wp-json/object-sync-for-salesforce/push/ REST endpoint to minimize the risk of exploitation.