CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API

Executive Summary

A high-severity unauthenticated SQL injection vulnerability has been disclosed in the Object Sync for Salesforce WordPress plugin. Tracked as CVE-2026-15162 with a CVSS score of 7.5 (High), the flaw exists in the plugin's REST API push endpoint. A missing authorization check in the permission callback allows unauthenticated attackers to inject arbitrary SQL via the wordpress_object_type parameter, potentially exposing the entire WordPress database.

Vulnerability Overview

Technical Details

The vulnerability exists in the REST API endpoint registered at /wp-json/object-sync-for-salesforce/push/. This endpoint is designed to handle incoming push notifications from Salesforce to synchronize objects with WordPress. The route's permission callback, can_process(), performs a method-only check — it verifies only the HTTP method used for the request, not whether the caller has any capability or valid authentication.

Because the permission check is effectively bypassed, the wordpress_object_type parameter — which is used to construct a database query — is passed unsanitized to a WordPress database function. The lack of proper parameterization or escaping in this query allows an attacker to inject arbitrary SQL.

Vulnerable Code Pattern

Permission callback (can_process()):
  - Checks HTTP method only
  - No nonce validation
  - No capability check
  - No API key or token validation
 
Query construction:
  - wordpress_object_type parameter injected directly into SQL
  - No parameterized query / prepare() call protecting the parameter

Attack Flow

1. Attacker identifies a WordPress site with Object Sync for Salesforce active
2. Sends a crafted POST request to /wp-json/object-sync-for-salesforce/push/
3. Injects malicious SQL via the wordpress_object_type parameter
4. WordPress database executes the injected query
5. Attacker extracts sensitive data: usernames, password hashes, emails, options

Impact

• Database exfiltration: Usernames, hashed passwords, email addresses, session tokens, and WordPress site options (wp_options) including API keys and configuration secrets can be extracted.
• Credential theft: Password hashes can be cracked offline, leading to account compromise.
• Confidential data exposure: Any data stored in the WordPress database — posts, custom fields, user metadata — is accessible to the attacker.
• Salesforce integration abuse: If Salesforce-connected records contain sensitive business data, those may also be at risk depending on the synchronization configuration.

Affected Versions

Remediation

1. Update immediately: Install the latest patched version of Object Sync for Salesforce from the WordPress plugin repository.
2. If no patch is available: Consider temporarily deactivating the plugin, especially on internet-facing sites, until a fix is released.
3. Restrict REST API access: Use a web application firewall (WAF) rule or server-level block to restrict access to /wp-json/object-sync-for-salesforce/push/ to known Salesforce IP ranges only.
4. Rotate credentials: If exploitation is suspected, reset WordPress user passwords and rotate any API keys stored in wp_options.
5. Review database logs: Inspect MySQL/MariaDB slow query logs or general logs for anomalous queries involving the affected table or unusual UNION SELECT patterns.

Detection

Look for HTTP POST requests to /wp-json/object-sync-for-salesforce/push/ in web server access logs, particularly those from unexpected source IPs outside known Salesforce address ranges. SQL injection probes often produce MySQL error messages in server logs — check for You have an error in your SQL syntax entries correlating with requests to this endpoint.

Indicators of SQL Injection Attempt

- UNION SELECT in request parameters
- ORDER BY with numeric values (used for column enumeration)
- Single quotes, double dashes (--), or hash (#) characters in wordpress_object_type
- Blind SQLi timing patterns: sleep(), benchmark() calls

References

• NVD — CVE-2026-15162
• WordPress Plugin Repository — Object Sync for Salesforce
• OWASP SQL Injection Prevention Cheat Sheet