CVE-2026-104932 johnny5 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Search Regex plugin version 3.5 should assess exposure and prioritize verification and remediation efforts. This includes reviewing plugin versions, restricting access to authenticated users, and monitoring for suspicious activity related to the replace_all function. Security teams and vulnerability management teams should also review and implement compensating controls for exposed systems while a

Why it matters

CVE-2026-104932 allows authenticated attackers to inject PHP objects and potentially execute code via a POP chain in the Search Regex plugin for WordPress version 3.5. Defenders should verify exposure, restrict access, and monitor activity.

• Code execution possible via POP chain
• Authenticated attackers can inject PHP objects
• Subscriber-level access sufficient for exploitation
• Verification of plugin version and access controls necessary

Technical summary

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code, making it critical for defenders to assess exposure and prioritize verification and remediation efforts across affected WordPress installations. Defenders should focus on verifying plugin versions, restricting access, and monitoring activity.

Defensive priority

Defenders should prioritize verifying exposure of Search Regex plugin version 3.5, restricting access to authenticated users, and monitoring for suspicious activity.

Recommended defensive actions

• Verify Search Regex plugin version and restrict access to authenticated users
• Monitor for suspicious activity and update plugin to patched version when available
• Review and restrict usage of replace_all function
• Conduct a thorough review of affected WordPress installations
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on affected versions, exploitation, and remediation is limited. Defenders should verify the presence of Search Regex plugin version 3.5, review access controls, and monitor for suspicious activity related to the replace_all function. The CVE Program and NVD entries offer official details, but further research may be needed to understand full scope and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.