Security: harden serialized data validation in the SQL editor (2.6.8)

docs/changelog.txt

@@ -1,3 +1,6 @@
+= 2.6.8 (2026-09-24) =
+* Security: hardened serialized data processing.
+
 = 2.6.7 (2025-01-15) =
 * Fixed secured unserialized data handling to prevent potential vulnerabilities.
 * Verified compatibility with WordPress 6.7

docs/readme.txt

@@ -4,8 +4,9 @@ Author URI: https://instawp.com/?utm_source=sl_plugin_author
 Plugin URI: http://wordpress.org/plugins/string-locator/
 Tags: text, search, find, syntax, highlight
 Requires at least: 4.9
-Tested up to: 6.7
-Stable tag: 2.6.7
+Requires PHP: 7.0
+Tested up to: 7.1
+Stable tag: 2.6.8
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -46,6 +47,9 @@ When writing your search string, make sure to wrap your search in forward slashe
 
 == Changelog ==
 
+= 2.6.8 (2026-09-24) =
+* Security: hardened serialized data processing.
+
 = 2.6.7 (2025-01-15) =
 * Fixed secured unserialized data handling to prevent potential vulnerabilities.
 * Verified compatibility with WordPress 6.7

includes/Extension/SQL/Tests/class-serialized-data.php

@@ -118,7 +118,22 @@ public function run( $content ) {
 		$this->errors = array();
 
 		if ( \is_serialized( $this->content ) ) {
-			$test_data = @unserialize( $this->content );
+			/*
+			 * This check only needs to know whether the value is well-formed
+			 * serialized PHP; it never needs the objects that value describes, and
+			 * the value itself is row content that the site owner did not
+			 * necessarily author. `allowed_classes => false` therefore keeps any
+			 * object in it from being instantiated during validation.
+			 *
+			 * Objects still decode to `__PHP_Incomplete_Class`, which is not
+			 * `false`, so the validity test below is unchanged for legitimate data.
+			 *
+			 * Enum cases are the one thing PHP does not gate here -- an `E:` value
+			 * still resolves to the real case. That is safe: an enum may not declare
+			 * `__wakeup()`, `__destruct()`, `__construct()`, `__serialize()` or
+			 * `__unserialize()`, so it cannot carry a gadget.
+			 */
+			$test_data = @unserialize( $this->content, array( 'allowed_classes' => false ) );
 
 			if ( 'b:0;' !== $this->content && false === $test_data ) {
 				$this->errors[] = array(

string-locator.php

@@ -3,7 +3,8 @@
  * Plugin Name: String Locator
  * Plugin URI: https://wordpress.org/plugins/string-locator/
  * Description: Scan through theme and plugin files looking for text strings
- * Version: 2.6.7
+ * Version: 2.6.8
+ * Requires PHP: 7.0
  * Author: InstaWP
  * Author URI: https://instawp.com/
  * Text Domain: string-locator