The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 through deserialization of untrusted input in the replace_all function. Authenticated users with subscriber-level access and higher may craft a malicious serialized string that injects a PHP object. When a POP chain is also present, the injected object can lead to arbitrary code execution on the host. This flaw falls under CWE-502, allowing attackers to gain remote control of the affected WordPress instance if the conditions are met.

The vulnerability impacts the Search Regex plugin version 3.5 released by the vendor johnny5 for WordPress sites. Any WordPress installation running this version of the plugin with subscriber or higher user roles is potentially affected. No other products or versions are listed in the CVE details.

The reported CVSS score is 8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires an authenticated subscriber or higher, indicating that the attacker must first obtain legitimate credentials or leverage an existing user account. Once authenticated, the attacker can use the replace_all functionality to deliver a malicious serialized payload and, with a suitable POP chain, achieve remote code execution. The risk remains significant given the high impact and the fact that the necessary conditions can be met on any vulnerable WordPress site hosting the plugin.