EUVD-2026-102679
GHSA-pg87-gj3v-m4jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as subscriber-level user
-
DeliverySubmit crafted serialized payload to replace_all
-
ExploitTrigger PHP object injection via unserialize
-
ExecutionPOP gadget chain executes code
-
ImpactRemote code execution on web server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with subscriber-level privileges or above on a site running Search Regex plugin version 3.5, and the request must reach the vulnerable replace_all function, which deserializes untrusted input. Escalation from PHP Object Injection to code execution additionally requires a usable POP gadget chain present in the installed plugin, WordPress core, or another active plugin. Limiting factors: authentication is mandatory (mitigated on sites that disable open user registration), only version 3.5 is affected (fixed in 3.5.1), and without a suitable gadget chain the impact may be limited to object injection rather than full RCE. |
| Impact | This is a credible but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates network-reachable exploitation with low attacker privileges and full confidentiality/integrity/availability impact, consistent with CWE-502 deserialization leading to remote code execution. The key constraint is PR:L: exploitation requires an authenticated account (subscriber-level or above), which is low-friction on sites allowing open registration but a real barrier on locked-down sites. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.0 reflects potential impact, not observed in-the-wild activity. One signal to reconcile: the description states RCE depends on 'the additional presence of a POP chain,' meaning weaponization into code execution requires a usable gadget chain in the plugin, WordPress core, or another installed plugin - so real-world impact ranges from object injection alone to full RCE depending on the target's plugin stack. The Wordfence-assigned UI:R is also worth verifying, since the description does not describe any required third-party user interaction (see confidence notes). |
| Exploit ScenarioDerived | An attacker registers or obtains a subscriber-level account on a WordPress site running Search Regex 3.5, then submits a crafted serialized payload through the plugin's replace_all functionality, which deserializes untrusted input. If a suitable POP gadget chain exists in the environment, the injected PHP object triggers arbitrary code execution on the web server. No public exploit code was identified in the provided intelligence at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
RemediationAI
Upgrade the Search Regex plugin to version 3.5.1, which is the vendor-released fix and resolves the unsafe deserialization in replace_all; the patch is available through the WordPress plugin repository and can be applied from the admin dashboard or by deploying the tagged 3.5.1 build manually. Because exploitation requires an authenticated account, tighten the account surface as a compensating control if immediate patching is not possible: disable or restrict open user registration so subscribers cannot self-provision, and audit existing low-privilege accounts for legitimacy. Deactivating the Search Regex plugin entirely removes the attack surface at the cost of losing bulk search-and-replace functionality, while restricting it to administrator-only roles reduces exposure but does not eliminate the underlying deserialization flaw. Note that the object-injection-to-code-execution escalation depends on a POP gadget chain, so reducing the number of third-party plugins and themes with known gadget chains lowers, but does not remove, residual risk - none of these workarounds are a substitute for applying the 3.5.1 update, and the authoritative guidance should be taken from the Wordfence advisory linked above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Search Regex plugin for WordPress (CPE cpe:2.3:a:johnny5:search_regex), specifically the replace_all function, which performs a search-and-replace over site content. The root cause maps to CWE-502, Deserialization of Untrusted Input: user-supplied input reaches PHP's object deserialization mechanism without adequate type or class restrictions, allowing an attacker to instantiate arbitrary PHP objects and manipulate their properties. PHP object injection is only the first stage; the second stage requires a POP (Property-Oriented Programming) gadget chain - a sequence of magic methods such as __wakeup, __destruct, or __toString across classes available in the application - that converts the injected object graph into a concrete impact such as code execution, file deletion, or SQL injection. The severity therefore depends heavily on the wider plugin/theme/core footprint of the target site: a site with a rich set of installed plugins is far more likely to expose a usable chain. The vulnerability class is well understood and, combined with the plugin's web-exposed request surface, makes sites running version 3.5 an attractive target for post-authentication attackers.
Know when Search Regex gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable function callable by an authenticated subscriber (PR:L); no third-party interaction is described (UI:N, differing from the vendor's UI:R); object injection with a POP chain yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
Executive ViewAI
Search Regex WordPress plugin version 3.5 contains a high-severity PHP object injection vulnerability that could enable attackers with subscriber-level access to achieve remote code execution and full site compromise when a compatible gadget chain is present. No public exploit code or active exploitation has been identified, but the absence of a vendor patch means affected organizations remain exposed. Leadership should prioritize immediate mitigation because successful exploitation could lead to data theft, website defacement, or operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the Search Regex plugin from all WordPress sites; restrict subscriber-level and higher accounts to only trusted users; deploy WAF rules to detect and block PHP object injection attempts, particularly serialized data in replace_all requests; enable monitoring for unexpected file modifications or code execution; and maintain regular backups for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB