Description

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T03:16:47.523Z",
  "pubdate": "2026-08-15T03:16:47.523Z",
  "executiveSummary": "The Object Sync for Salesforce plugin suffers from an unauthenticated SQL Injection vulnerability residing within its REST API endpoint. The vulnerability is triggered via the wordpress_object_type parameter exposed in the /wp-json/object-sync-for-salesforce/push/ REST route. Due to inadequate access control implementation and a complete absence of input sanitization or parameterization, unauthenticated remote attackers can manipulate database queries executed by the application.\nThe primary impact of this security flaw includes unauthorized database access, data exfiltration, and potential compromise of the underlying WordPress installation. Attackers can leverage time-based blind SQL injection techniques to extract sensitive information, such as user password hashes, directly from the database without requiring prior authentication or an active Salesforce connection. The risk is significantly elevated because the vulnerable endpoint relies solely on HTTP method verification rather than enforcing robust cryptographic nonces or user capability checks.\nExploitation requires network access to the target WordPress REST API route and knowledge of a valid wordpress_id. Given the prevalence of automated scanning tools targeting exposed WordPress plugins, this vulnerability presents a critical threat to confidentiality and integrity for deployments utilizing the Object Sync for Salesforce plugin.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of special elements used in an SQL command, classified as SQL Injection. The vulnerable component is the REST route /wp-json/object-sync-for-salesforce/push/, specifically handled by the push class within the plugin architecture. The permission callback function, can_process(), fails to validate user capabilities, roles, or nonces, restricting its security checks exclusively to the HTTP method. Consequently, the endpoint is publicly accessible to unauthenticated users over the network.\nDuring execution, the wordpress_object_type parameter supplied in the REST request body is handled insecurely. Specifically, the value of wordpress_object_type is concatenated directly into an SQL query string (post_type = \"$object_type\" at class-object-sync-sf-wordpress.php:328) without prior sanitization or escaping. Because REST API body parameters are not subjected to magic-quoted behaviors, an attacker can readily inject malicious SQL syntax to break out of the intended string context. This unsanitized query is subsequently passed to the WordPress database abstraction layer via $wpdb->get_results() without utilizing the $wpdb->prepare() method (line 578).\nThe attack flow proceeds in a sequential manner. First, an unauthenticated attacker crafts an HTTP request targeting the /wp-json/object-sync-for-salesforce/push/ endpoint, providing a valid wordpress_id alongside a maliciously crafted payload within the wordpress_object_type parameter. Second, the application receives the request, and the can_process() function grants access due to the lack of proper authentication and authorization controls. Third, the application concatenates the attacker-controlled input directly into the SQL statement. Fourth, the database executes the resulting query.\nBecause the execution flow permits arbitrary SQL injection, attackers can utilize time-based blind SQL injection methodologies to infer data character by character. This post-exploitation capability enables the extraction of highly sensitive database contents, including administrator credentials, session tokens, and user password hashes, thereby compromising the security posture of the WordPress environment."
}