CVE-2026-104932

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

CVE-2026-104932 Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

CVE-2026-104932 Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

EUVD-2026-102679

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

CVE-2026-104932

The Search Regex plugin for WordPress (version 3.5 and below) is vulnerable to PHP Object Injection due to the deserialization of untrusted input within the replace_all function. This flaw allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object, which can lead...

CVE-2026-104932: Deserialization of Untrusted Data

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

WordPress SearchRegex deserialization injection vulnerability

WordPress SearchRegex versions 3.5 and earlier have a deserialization injection vulnerability. This vulnerability stems from the deserialization of untrusted inputs in the replaceall function. It may allow authenticated attackers with subscription or higher privileges to inject PHP objects and...