CVE-2026-15162 describes an SQL Injection vulnerability in the Object Sync for Salesforce WordPress plugin. The REST route /wp-json/object-sync-for-salesforce/push/ accepts a wordpress_object_type parameter that is concatenated directly into a SQL query without using $wpdb->prepare(), allowing injection of arbitrary SQL commands. The permission callback for this route only verifies the HTTP method, lacking capability or nonce checks, which permits unauthenticated access. Attackers can perform time-based blind SQL injection to extract sensitive information such as password hashes. The vulnerability requires only a valid wordpress_id parameter and no authentication or Salesforce connection. The plugin is a cloud service, and a patch is available though no explicit remediation details are provided.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks against the WordPress database used by the Object Sync for Salesforce plugin. This can lead to unauthorized disclosure of sensitive information, including password hashes. The vulnerability does not affect integrity or availability directly but poses a significant confidentiality risk. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation on the server side. Users should verify with the vendor advisory that the service has been updated to address this issue. No additional action is required if the vendor confirms mitigation. If using a self-hosted version, apply the official patch that properly sanitizes and prepares SQL queries and enforces appropriate permission checks on the REST route.