CVE-2026-15162 describes an unauthenticated SQL Injection vulnerability in the Object Sync for Salesforce plugin for WordPress. The vulnerability arises because the wordpress_object_type parameter from the REST API route /wp-json/object-sync-for-salesforce/push/ is concatenated directly into a SQL query without proper sanitization or use of prepared statements. The permission callback only checks the HTTP method and does not enforce capability or nonce verification, making the endpoint accessible to unauthenticated users. Attackers can exploit this to perform time-based blind SQL injection attacks to extract sensitive information such as password hashes. The vulnerability affects the cloud-hosted service version of the plugin.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the backend database, potentially extracting sensitive information including password hashes. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is remotely exploitable without authentication.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied. No additional action is required if the vendor confirms mitigation.