Object Sync For Salesforce
Monthly
Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.
Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.