CVE-2026-104932: Search Regex WordPress Plugin RCE Vulnerability

CVE-2026-104932 Overview

CVE-2026-104932 is a PHP Object Injection vulnerability in the Search Regex plugin for WordPress, version 3.5. The flaw resides in the replace_all function, which deserializes untrusted input without validation. Authenticated users with Subscriber-level access or higher can inject arbitrary PHP objects into the application. When combined with a Property-Oriented Programming (POP) chain present in the environment, attackers can escalate the injection to arbitrary code execution. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact

Authenticated attackers with minimal privileges can inject PHP objects into the deserialization process. The presence of a POP chain enables full remote code execution on affected WordPress installations.

Affected Products

• Search Regex plugin for WordPress, version 3.5
• WordPress sites running the vulnerable plugin with Subscriber-level or higher user accounts
• Fixed in Search Regex version 3.5.1

Discovery Timeline

• 2026-10-16 - CVE-2026-104932 published to the National Vulnerability Database
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104932

Vulnerability Analysis

The Search Regex plugin provides WordPress administrators with pattern-based search and replace functionality across post content, metadata, and other database fields. In version 3.5, the replace_all function processes user-controlled input through PHP's unserialize() function without sanitizing the data first.

PHP Object Injection occurs when attacker-controlled serialized data reaches unserialize(). The function instantiates arbitrary PHP objects of any class loaded in the application scope. Magic methods such as __wakeup(), __destruct(), and __toString() execute automatically during or after instantiation.

An attacker chains these magic methods through loaded classes to build a POP (Property-Oriented Programming) chain. The chain can trigger file writes, SQL execution, or arbitrary command execution depending on the classes available in the WordPress core and installed plugins.

Root Cause

The root cause is the use of PHP's native unserialize() function on data originating from authenticated HTTP requests without integrity checks. The replace_all handler trusts input that should be treated as untrusted. Capability checks restrict access to Subscriber level, but Subscriber accounts are frequently created through public registration on many WordPress sites.

Attack Vector

Exploitation requires an authenticated session with Subscriber privileges or higher. The attacker crafts a serialized PHP payload referencing a gadget chain available in the target environment. The payload is submitted to the plugin endpoint that invokes replace_all, triggering deserialization and gadget chain execution. User interaction is required to complete the attack flow, which may involve a tricked administrator action in some exploitation paths.

Technical details of the patched code path are available in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-104932

Indicators of Compromise

• HTTP POST requests to Search Regex plugin endpoints containing serialized PHP data patterns such as O:, a:, or s: followed by class names and object properties
• New or modified PHP files in the WordPress uploads directory or plugin directories following requests from low-privilege accounts
• Unexpected outbound network connections initiated by the php-fpm or web server process after plugin interaction
• Subscriber accounts created through self-registration that subsequently interact with administrative plugin endpoints

Detection Strategies

• Inspect web server access logs for POST requests to the Search Regex plugin REST API or admin-ajax endpoints originating from non-administrative user sessions
• Monitor PHP error logs for __wakeup, __destruct, or unserialize warnings referencing unexpected class names
• Deploy a Web Application Firewall rule that blocks serialized object patterns in request bodies targeting the plugin
• Alert on process creation chains where the web server spawns shell interpreters such as sh, bash, or cmd.exe

Monitoring Recommendations

• Enable file integrity monitoring across the WordPress root, wp-content/plugins, and wp-content/uploads directories
• Audit WordPress user tables for privilege escalation events immediately following plugin API calls
• Centralize web server, PHP, and WordPress audit logs in a SIEM for correlation across request, process, and file events
• Track installed plugin versions through configuration management to identify unpatched Search Regex instances across hosted sites

How to Mitigate CVE-2026-104932

Immediate Actions Required

• Update the Search Regex plugin to version 3.5.1 or later on all WordPress installations
• Disable the Search Regex plugin on sites where immediate patching is not feasible
• Review and remove Subscriber-level accounts that were created through self-registration and have not been verified
• Rotate WordPress secret keys in wp-config.php if exploitation is suspected

Patch Information

The Search Regex maintainers released version 3.5.1, which remediates the deserialization flaw in the replace_all function. Review the code changes in the WordPress Plugin Changeset. Site administrators should apply the update through the WordPress plugin manager or by replacing the plugin files directly.

Workarounds

• Disable open user registration under WordPress Settings → General to prevent attackers from obtaining Subscriber accounts
• Restrict access to the WordPress admin area and REST API endpoints by IP allowlist at the web server or firewall layer
• Deploy a WAF ruleset that blocks serialized PHP objects in HTTP request bodies and query strings
• Remove the Search Regex plugin from production sites where the search and replace functionality is not required

# Configuration example: disable user self-registration via WP-CLI
wp option update users_can_register 0

# Update the Search Regex plugin to the patched release
wp plugin update search-regex --version=3.5.1

# Verify installed plugin version
wp plugin get search-regex --field=version