Executive brief
The Object Sync for Salesforce WordPress plugin contains an unauthenticated SQL injection vulnerability in its REST API endpoint. An attacker can submit malformed requests to extract sensitive information such as password hashes from the WordPress database without needing any credentials or Salesforce account access. This could lead to account compromise and unauthorized access to the website.
Technical details
The vulnerability is a SQL injection (SQLi) in the /wp-json/object-sync-for-salesforce/push/ REST route, where the wordpress_object_type parameter is concatenated directly into a SQL query without prepared statements. The route's permission callback (can_process()) validates only the HTTP method and does not check user capabilities or nonces, making it reachable by unauthenticated users. The vulnerable code concatenates the parameter into a SQL query (post_type = "$object_type") and executes it via $wpdb->get_results() without $wpdb->prepare(). An attacker can break out of the quoted string and append arbitrary SQL queries to perform time-based blind SQL injection, extracting data such as password hashes. Only a valid wordpress_id (e.g., 1) is required as a precondition; no authentication or Salesforce connection is necessary.
Affected products
- WordPress Object Sync for Salesforce <UNKNOWN>
Timeline
- 2026-08-15: disclosed