CVE-2026-15162: Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (canprocess()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpressobjecttype value is concatenated directly into a SQL query (posttype = "$objecttype", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->getresults() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpressid (e.g. 1) is required — no authentication or Salesforce connection.