CVE-2026-104932: PHP Object Injection in Search Regex WordPress Plugin

CVE-2026-104932 is a critical security vulnerability found in the Search Regex plugin for WordPress, specifically affecting version 3.5. The vulnerability resides within the 'replace_all' function, which performs insecure deserialization of untrusted input provided by a user. Because the plugin does not adequately validate or sanitize the data before deserializing it, an authenticated attacker with at least subscriber-level permissions can inject a malicious PHP object. The presence of a property-oriented programming (POP) chain within the application context enables the attacker to leverage this injection to execute arbitrary code on the underlying server. Given that subscriber-level accounts are often easily obtainable via registration or compromise, this vulnerability presents a significant risk for privilege escalation and full site compromise.

Impact

Successful exploitation of CVE-2026-104932 results in remote code execution (RCE) on the WordPress server. This allows attackers to gain full control over the compromised site, potentially leading to data exfiltration, the deployment of backdoors, or lateral movement into the hosting infrastructure. The vulnerability affects all WordPress installations utilizing version 3.5 of the Search Regex plugin.

Recommendation

Prioritize the immediate update of the Search Regex plugin. If an update addressing this vulnerability is not available, disable the plugin until a patch is applied.

• Update the Search Regex plugin to the latest version that remediates CVE-2026-104932 immediately.
• Review web server logs for suspicious POST requests targeting the Search Regex plugin functionality, specifically monitoring for unusual serialized data strings in application parameters.
• Audit user accounts to identify and disable unauthorized or suspicious subscriber-level accounts that could be used as an initial access vector for this vulnerability.