An unauthenticated SQL injection vulnerability in the Object Sync for Salesforce plugin allows attackers to compromise database integrity and confidentiality.

This is an SQL Injection vulnerability (CWE-89) located in the plugin's REST API route. An unauthenticated attacker can inject malicious SQL commands via the wordpress_object_type parameter, allowing unauthorized database access.

With a CVSS score of 7.5, this vulnerability represents a significant risk to data privacy. Attackers can bypass authentication to read sensitive information directly from the WordPress database, potentially leading to unauthorized data exposure, exposure of administrative credentials, or full database compromise.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and uninstall the Object Sync for Salesforce plugin until a secure version is released.

Proactive Monitoring: Review database query logs for suspicious patterns or unexpected REST API calls targeting the /wp-json/object-sync-for-salesforce/push/ endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests containing SQL keywords targeting the vulnerable REST API path.

Public Exploit Available: No (exploit_available: false).

Because no patch has been released, the only effective way to mitigate this risk is to remove the vulnerable plugin from the production environment. Organizations relying on this plugin for Salesforce integration must seek alternative synchronization methods or isolate the affected service until the vendor provides a security update.