SQL Injection Vulnerability in Object Sync for Salesforce Plugin

CVE-2026-15162

What is CVE-2026-15162?

The Object Sync for Salesforce plugin has a significant SQL Injection vulnerability that allows unauthenticated users to exploit the /wp-json/object-sync-for-salesforce/push/ REST route. Due to insufficient permission checks, the endpoint can be accessed without authentication, making it possible for attackers to inject arbitrary SQL by manipulating the wordpress_object_type parameter. The vulnerability arises because the parameter is directly concatenated into a SQL query and executed without proper sanitization, allowing attackers to execute additional SQL commands and potentially extract sensitive data such as password hashes. This risk highlights the importance of robust security practices in WordPress plugin development.

References