CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection
Unauthenticated attackers can inject SQL via the wordpress_object_type parameter to extract sensitive database information, including password hashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15162?
CVE-2026-15162 is a high-severity SQL injection vulnerability in minnpost Object Sync for Salesforce, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.
Weakness: CWE-89
Which versions are affected by CVE-2026-15162?
How do I fix CVE-2026-15162?
No fix has been published for CVE-2026-15162 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-15162 being exploited?
There is no known exploitation of CVE-2026-15162 in the wild and no public exploit code.
Sources
Also known as GHSA-5x6m-wm6g-mfv9.