PHP Object Injection Vulnerability in Search Regex Plugin for WordPress

CVE-2026-104932

What is CVE-2026-104932?

The Search Regex plugin for WordPress is susceptible to a PHP Object Injection vulnerability resulting from the unsafe deserialization of untrusted input in the replace_all function. This issue allows authenticated users, including those with subscriber-level access and above, to inject a PHP Object. Furthermore, the presence of a POP chain permits the execution of arbitrary code, posing significant risks to the integrity and security of the affected WordPress installations.

References