CVE-2026-15162: Unauthenticated SQL Injection in Object Sync for Salesforce Plugin

The Object Sync for Salesforce plugin for WordPress is vulnerable to an unauthenticated SQL injection via the 'wordpress_object_type' parameter within the REST API endpoint '/wp-json/object-sync-for-salesforce/push/'. The vulnerability exists because the plugin's permission callback, 'can_process()', fails to enforce nonce or capability checks, making the route accessible to any unauthenticated user. The input is then concatenated directly into a SQL query within the 'class-object-sync-sf-wordpress.php' file at line 328 and executed via '$wpdb->get_results()' without utilizing '$wpdb->prepare()'. Because WordPress REST API body parameters lack sanitization, an attacker can break out of the string context and inject arbitrary SQL commands, potentially leading to database exfiltration, including the dumping of user password hashes.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the underlying WordPress database. This can result in the exfiltration of sensitive configuration data, user account details, and password hashes, leading to full site compromise or account takeover.

Recommendation

1. Update the Object Sync for Salesforce plugin to the latest patched version immediately to remediate CVE-2026-15162.
2. Implement the provided Sigma rule at the webserver layer to detect and block exploitation attempts targeting the specific vulnerable endpoint.
3. Audit access logs for anomalous POST requests to '/wp-json/object-sync-for-salesforce/push/' containing suspicious SQL keywords (e.g., SLEEP, UNION, SELECT).