CVE-2026-104932
8.0HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated attackers with subscriber-level access or above can execute arbitrary code on the WordPress server if a POP chain is present, though it requires user interaction. They only need low-privilege credentials and network access to the WordPress site.
Root cause
The replace_all function deserializes untrusted user input without validation, allowing PHP Object Injection.
Affected systems
Search Regex plugin for WordPress version 3.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the Search Regex plugin to version 3.5.1 or later. If updating immediately is not possible, deactivate the Search Regex plugin.
$ wp plugin update search-regex --version=3.5.1AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.