MajorCritical vulnerability

CVE-2026-104932 (CVSS 8.0)

NVD · officialPublished Oct 16, 2026Risk 37/100EPSS 0.3%

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

Technical details

CVSS

8.0

AV:NetworkAC:LowPR:LowUI:RequiredC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source