CVE-2026-104932
Received Received - Intake

PHP Object Injection in Search Regex WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-104932
EUVD
EUVD-2026-102679

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
johnny5 Search Regex 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Search Regex plugin for WordPress has a PHP Object Injection vulnerability in version 3.5. It occurs due to unsafe deserialization of user input in the replace_all function. Attackers with subscriber-level access or higher can exploit this to inject a PHP object. If a POP (Property-Oriented Programming) chain exists, this can lead to arbitrary code execution.

Detection Guidance

Check if the Search Regex plugin version 3.5 or below is installed on your WordPress site. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin directory for the vulnerable version.

Impact Analysis

If you use the vulnerable Search Regex plugin version 3.5, an attacker with subscriber access or higher could exploit this flaw to execute malicious code on your WordPress site. This could lead to full site compromise, data theft, or further attacks against your users or server.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive user data. This may violate GDPR (data protection) and HIPAA (health data privacy) requirements, depending on the data processed. Compliance could be impacted if the breach results in data exposure or loss of integrity.

Mitigation Strategies

Update the Search Regex plugin to the latest version immediately. If an update is unavailable, consider disabling or removing the plugin until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart