CVE-2026-15162

creationtimestamp| type| source ---|---|--- 2026-08-15 10:16:27+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mt4gxgkuw62p...

CVE-2026-15162 Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...