CVE-2026-104932: Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level privileges. Exploitation also requires user interaction.
What additional condition is needed for code execution?
The object injection must be paired with a usable PHP POP chain. The available data does not identify which installed components may provide such a chain.
Which plugin version is identified as vulnerable?
The issue is identified in Search Regex version 3.5. The supplied change reference compares version 3.5 with 3.5.1, but the data does not explicitly state the fixed version.