The Object Sync for Salesforce plugin exposes an unauthenticated SQL injection vulnerability through the wordpress_object_type parameter on the /wp-json/object-sync-for-salesforce/push/ REST route. The permission callback validates only the HTTP method, allowing anyone to reach the endpoint without credentials or a nonce. The plugin concatenates the received object type directly into a SQL query that is executed via $wpdb->get_results() without preparation, enabling an attacker to terminate the quoted string and inject arbitrary SQL. This can lead to time‑based blind exploitation and extraction of sensitive data such as password hashes from the database, with only a valid WordPress ID required.

Affected is the WordPress plugin Object Sync for Salesforce from minnpost, versions 2.2.13 and earlier. The plugin is deployed on any WordPress site that uses the push REST route.

The CVSS score of 7.5 indicates a high severity. EPSS is not available, so the exploitation probability cannot be quantified, but the vulnerability is listed as not in the CISA KEV catalog. Because no authentication is required, an attacker only needs to send a crafted POST request to the exposed REST endpoint, which is reachable from the public internet. The ability to extract password hashes or other sensitive data makes this a serious risk for sites with exposed MySQL databases.