Search Regex
Search Regex has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 8.0, and the most serious one scores 8.0 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).
The one issue recorded for Search Regex has a vendor fix available, so running the current release closes it.
All of these findings were reported by R3D. Search Regex is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-104932Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
Read the full analysisVulnerability Records

Search Regex
Author
John Godley
Search Regex adds a powerful set of search and replace functions to WordPress posts, pages, custom post types, and other data sources. These go beyond the standard searching capabilities, and allow you to search and replace almost any data stored on your site. In addition to simple searches you have the full power of PHP’s regular expressions at your disposal. You can use this to do things like: – Help migrate a site from one domain to another – Update URLs in links and images – Perform site-wide changes Search filters can be created to match any column of any WordPress table. For example: – Find all posts in a category – Find all post meta data without a post – Find all posts in a date range Search Regex handles small and large sites. Search Regex has been tested with PHP from 7.4 to 8.4. What can I search? You can search: – Posts – Pages – Any custom post type – Comments (including spam) – Users – Meta data – WordPress options Full regular expression support is provided, and you can capture data and use it in the replacement. Actions A variety of actions can be performed on matching results: – Modify and replace the result – Delete the result – Export to CSV and SQL – Perform custom PHP action Modify and Replace Data Results can be individually modified by clicking on the item to change, and using the popup modifier. Bulk modifications can be performed against all matching results. The types of modification depend on the data being changed: – Numbers can be added or subtracted to existing numbers – Hours, days, weeks, and months, can be added to dates – Tags and categories can be added, removed, and substitued Custom shortcodes are supported that allow dynamic data to be included: – Add the current date and time, in any format, to content – Insert data from other columns. For example, insert the category into the title – Transform existing data. For example, convert case, change underscores to dashes. Example uses Some ideas for potential uses: – Delete all comments that match a phrase – Add a category to all matching posts – Remove orphaned meta data Support Please submit bugs, patches, and feature requests to: https://github.com/johngodley/search-regex Please submit translations to: https://translate.wordpress.org/projects/wp-plugins/search-regex Translations Translations are provided by WordPress itself. You can update the translations by going to the Dashboard > Updates section of WP admin. Documentation Full documentation can be found on the Search Regex site.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C