{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asearch_regex_projectsearch_regex3.5wordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:search_regex_project:search_regex:3.5:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-104932"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Search Regex (3.5)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","php-injection"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2026-104932 is a critical security vulnerability found in the Search Regex plugin for WordPress, specifically affecting version 3.5. The vulnerability resides within the 'replace_all' function, which performs insecure deserialization of untrusted input provided by a user. Because the plugin does not adequately validate or sanitize the data before deserializing it, an authenticated attacker with at least subscriber-level permissions can inject a malicious PHP object. The presence of a property-oriented programming (POP) chain within the application context enables the attacker to leverage this injection to execute arbitrary code on the underlying server. Given that subscriber-level accounts are often easily obtainable via registration or compromise, this vulnerability presents a significant risk for privilege escalation and full site compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-104932 results in remote code execution (RCE) on the WordPress server. This allows attackers to gain full control over the compromised site, potentially leading to data exfiltration, the deployment of backdoors, or lateral movement into the hosting infrastructure. The vulnerability affects all WordPress installations utilizing version 3.5 of the Search Regex plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the Search Regex plugin. If an update addressing this vulnerability is not available, disable the plugin until a patch is applied.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Search Regex plugin to the latest version that remediates CVE-2026-104932 immediately.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious POST requests targeting the Search Regex plugin functionality, specifically monitoring for unusual serialized data strings in application parameters.\u003c/li\u003e\n\u003cli\u003eAudit user accounts to identify and disable unauthorized or suspicious subscriber-level accounts that could be used as an initial access vector for this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:25:05Z","date_published":"2026-10-16T08:25:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-search-regex-poi/","summary":"The Search Regex WordPress plugin version 3.5 is vulnerable to PHP Object Injection, allowing authenticated users with subscriber access to achieve remote code execution via a POP chain.","title":"CVE-2026-104932: PHP Object Injection in Search Regex WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-search-regex-poi/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:search_regex_project:search_regex:3.5:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}