High severity8.0NVD Advisory· Published Oct 16, 2026

CVE-2026-104932

Description

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

Affected products

WordPress/Search Regexllm-create
Range: <3.5.1

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3cnvd

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000