CVE-2026-15162 in Object Sync for Salesforce Plugin
Summary
by MITRE • 08/15/2026
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The Object Sync for Salesforce plugin presents a critical security vulnerability that exploits an unauthenticated sql injection flaw within its rest api endpoint. This vulnerability specifically targets the /wp-json/object-sync-for-salesforce/push/ route which lacks proper authentication mechanisms, allowing any remote attacker to exploit the system without requiring valid credentials or salesforce connection details. The weakness stems from the permission callback function can_process() which only validates the http method for the push class but fails to implement any capability checks or nonce verification, creating an unauthorized access vector that fundamentally undermines the plugin's security model.
The technical exploitation occurs through the wordpress_object_type parameter within the rest route where the input value gets directly concatenated into a sql query without proper sanitization or preparation. The vulnerable code at line 328 in class-object-sync-sf-wordpress.php constructs the sql statement using post_type = "$object_type" format, while the execution at line 578 utilizes $wpdb->get_results() method without employing $wpdb->prepare() for parameter binding. This direct concatenation approach creates a classic sql injection vulnerability where attackers can manipulate the query structure by breaking out of the quoted string context through the rest body parameters that are not subject to magic quoting mechanisms in wordpress.
The operational impact of this vulnerability extends beyond simple data extraction to include potential system compromise and information disclosure. Attackers can leverage time-based blind sql injection techniques to extract sensitive database information including password hashes, user credentials, and other confidential data stored within the wordpress installation. The attack requires only a valid wordpress_id value such as 1, eliminating the need for authentication or salesforce connection, making this vulnerability particularly dangerous as it can be exploited by anyone with access to the target website's rest api endpoint. This vulnerability directly aligns with cwe-89 sql injection weakness and maps to attack techniques in the att&ck framework under initial access and credential access phases.
The security implications of this flaw represent a significant risk to wordpress installations using the object sync for salesforce plugin, as it allows unauthorized data exfiltration and potential system compromise. Organizations relying on this plugin without proper network segmentation or additional security controls face exposure to attackers who can systematically extract database contents through carefully crafted sql injection payloads. The vulnerability demonstrates poor input validation practices and highlights the critical importance of implementing proper parameter binding for all database operations, particularly within rest api endpoints that may be exposed to unauthenticated users. Mitigation strategies should include immediate plugin updates, implementation of web application firewalls, and comprehensive security monitoring to detect exploitation attempts, while the underlying architectural flaw requires proper authentication enforcement and sql query preparation practices to prevent similar vulnerabilities in future implementations.