{"id":"CVE-2026-104932","kind":"vulnerability","aliases":["CVE-2026-104932"],"related":[],"title":"WordPress Search Regex plugin: object injection lets subscribers run code","description":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.","summary":"The Search Regex plugin for WordPress version 3.5 deserializes untrusted input in its replace_all function, letting an attacker inject a PHP object. When a POP chain is present in the installed code, the injected object can be used to execute code on the server.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["different-plugin-version","plugin-not-installed"],"how_to_check":"- Check the installed Search Regex plugin version in the WordPress admin plugins list or with `wp plugin get search-regex --field=version`\n- Look for the replace_all function in the plugin's source for unsafe calls to unserialize on request input (unknown whether the sources give a file path)","fix":"- Update the Search Regex plugin to a version newer than `3.5` (the fixed version number is unknown from the sources)\n- If no fixed version exists, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-16T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:07:59+00:00","updated_at":"2026-10-25T03:07:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:07:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Search Regex plugin to a version newer than `3.5` (the fixed version number is unknown from the sources)\n- If no fixed version exists, deactivate the plugin until it is patched","reach":"internet","title":"WordPress Search Regex plugin: object injection lets subscribers run code","impact":"high","summary":"The Search Regex plugin for WordPress version 3.5 deserializes untrusted input in its replace_all function, letting an attacker inject a PHP object. When a POP chain is present in the installed code, the injected object can be used to execute code on the server.","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated subscriber can execute code on the server via PHP object injection","analyst_note":"Find the fixed plugin version and the vulnerable file path in the NVD entry or the WordPress plugin changelog; confirm whether the POP chain requirement is met by default.","how_to_check":"- Check the installed Search Regex plugin version in the WordPress admin plugins list or with `wp plugin get search-regex --field=version`\n- Look for the replace_all function in the plugin's source for unsafe calls to unserialize on request input (unknown whether the sources give a file path)","needs_analyst":true,"not_affected_if":["plugin-not-installed","different-plugin-version"],"who_is_affected":"Sites running the Search Regex WordPress plugin at version 3.5 are exposed, and the attacker needs at least a subscriber-level account. Exploitation also depends on a POP chain being available in the site's loaded PHP code, so the exact exposure depends on installed plugins and themes. Sites that do not run this plugin version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":3330,"output_tokens":639,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104932':13A,16A '-2026':12A,15A '3.5':30B,82C 'access':101C 'addit':110C 'allow':94C,116C 'attack':41B,96C,117C 'authent':95C 'chain':49B,115C 'code':10A,55B,64B,120C 'cve':11A,14A 'deseri':31B,84C 'execut':63B,119C 'function':38B,92C 'host':21B 'inject':6A,42B,57B,79C,105C 'input':33B,87C 'instal':54B 'let':7A,39B 'level':100C 'object':5A,45B,58B,78C,108C 'packag':17B 'php':18B,44B,77C,107C 'plugin':4A,26B,71C 'pop':48B,114C 'presenc':111C 'present':51B 'regex':3A,25B,70C 'replac':36B,90C 'run':9A 'search':2A,24B,69C 'self':20B 'self-host':19B 'server':67B 'subscrib':8A,99C 'subscriber-level':98C 'untrust':32B,86C 'use':61B 'version':29B,81C 'via':83C 'vulner':75C 'wordpress':1A,22B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Search Regex WordPress plugin at version 3.5 are exposed, and the attacker needs at least a subscriber-level account. Exploitation also depends on a POP chain being available in the site's loaded PHP code, so the exact exposure depends on installed plugins and themes. Sites that do not run this plugin version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104932","severity":null,"published_at":"2026-10-16T06:17:05+00:00","modified_at":"2026-10-16T15:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}