GHSA-pg87-gj3v-m4jxHighCVSS 8.0
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via...
🔗 CVE IDs covered (1)
📋 Description
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
🔗 References (4)
- https://nvd.nist.gov/vuln/detail/CVE-2026-104932
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve
- https://github.com/advisories/GHSA-pg87-gj3v-m4jx