CVE-2026-104932

HIGH 8.0

Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

CWE	CWE-502
Vendor	johnny5
Product	search regex
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for johnny5 search regex

Be the first to know when new high vulnerabilities affecting johnny5 search regex are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

johnny5 / Search Regex

0 ≤ 3.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5

Credits

R3D