{"id":"CVE-2026-104932","revision":"284f94fd344b4c3185702fd861b08b70","records":[{"revision":"284f94fd344b4c3185702fd861b08b70","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104932","aliases":[],"title":"Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption","description":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.","state":0,"publishedAt":"2026-10-16T05:30:27.126+00:00","modifiedAt":"2026-10-16T14:53:13.234+00:00","affected":[{"ecosystem":"Vendor product","name":"Search Regex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"johnny5\",\n                    \"product\": \"Search Regex\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"3.5\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8,"severity":"HIGH"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve","https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104932","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104932","identifiers":["CVE-2026-104932"]},"retained":false,"historicalAffected":[]}],"coverage":[]}