Live › vulnerability › CVE-2026-104932
Go to dashboardThe Search Regex plugin for WordPress version 3.5 deserializes untrusted input in its replace_all function, letting an attacker inject a PHP object. When a POP chain is present in the installed code, the injected object can be used to execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Search Regex WordPress plugin at version 3.5 are exposed, and the attacker needs at least a subscriber-level account. Exploitation also depends on a POP chain being available in the site's loaded PHP code, so the exact exposure depends on installed plugins and themes. Sites that do not run this plugin version can skip it.
No product ranges from the sources yet.
wp plugin get search-regex --field=version3.5 (the fixed version number is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-104932")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.