Atomic Edge analysis of CVE-2026-15162 (metadata-based):
This vulnerability is an unauthenticated SQL injection in the Object Sync for Salesforce plugin, version 2.2.13 and earlier. The affected component is the WordPress REST API push route, specifically /wp-json/object-sync-for-salesforce/push/. The vulnerability allows unauthenticated attackers to inject arbitrary SQL into database queries through the wordpress_object_type parameter, leading to potential extraction of sensitive data such as password hashes. The CVSS score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network-based exploitation with no privileges or user interaction required.
Root Cause:
Atomic Edge analysis infers the root cause from the CWE classification (CWE-89) and the provided description. The plugin’s REST route permission callback, can_process(), checks only the HTTP method for the push class, not any user capabilities or nonces, allowing unauthenticated access. The wordpress_object_type parameter is concatenated directly into a SQL query, specifically in the condition post_type = “$object_type”, and then passed to $wpdb->get_results() without using $wpdb->prepare(). Because the parameter is not adequately sanitized or escaped, an attacker can break out of the string literal and append arbitrary SQL. This conclusion is inferred from the description and CWE, but the specific code locations confirm the lack of prepared statements and inadequate access controls.
Exploitation:
The attack vector is a crafted HTTP POST (or possibly GET) request to the REST API endpoint /wp-json/object-sync-for-salesforce/push/. The attacker supplies a valid wordpress_id (e.g., 1) and a malicious wordpress_object_type parameter. For example, the parameter could be set to ‘ OR 1=1 UNION SELECT user_login,user_pass FROM wp_users — to extract user credentials. Because the REST API does not require authentication or nonces, the attacker can execute the request without any prior access. The injection is possible because REST body parameters are not magic-quoted and the plugin uses unsafe concatenation. Time-based blind injection can also be used to enumerate data when the attacker cannot see direct query results.
Remediation:
Atomic Edge analysis recommends the fix implement prepared statements using $wpdb->prepare() for all database queries involving user-supplied input. The wordpress_object_type parameter should be validated against a whitelist of allowed object types. Additionally, the REST route’s permission callback should enforce user authentication and check appropriate capabilities (e.g., edit_posts or a custom capability) for the push functionality. The plugin should also sanitize and escape all data before using it in queries or output. Since the vendor has not released a patched version, affected users should immediately disable the plugin or restrict access to the REST endpoint via WAF rules or server-level IP allowlisting until a fix is available.
Impact:
Successful exploitation allows unauthenticated attackers to read arbitrary data from the WordPress database, including user password hashes, session tokens, and other sensitive configuration data. Since the attacker can execute arbitrary SQL, they could potentially manipulate data, although the CVSS indicates confidentiality impact only (C:H/I:N/A:N). With extracted password hashes, attackers can attempt offline cracking or use the hashes for further attacks, potentially leading to full site compromise if a user account is compromised. The vulnerability does not require an active Salesforce connection, making it widely exploitable on any vulnerable installation.
