plugin

Object Sync For Salesforce Vulnerabilities

1 known security issue reported for the Object Sync For Salesforce WordPress plugin. Most recent disclosed Aug 14, 2026.

1 high

Running Object Sync For Salesforce on your site? Check whether your installed version is affected.

Scan your site free

Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

high

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is rea...

CVSS:: 7.5
Affected:: up to 2.2.13
Fix:: No patched version reported
Disclosed:: Aug 14, 2026

CVE-2026-15162 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database