Live › vulnerability › CVE-2026-115806
Go to dashboardPrime Mover, a WordPress backup and migration plugin, unserializes attacker-supplied data stored in comment content during export or restore, for all versions up to and including 2.2.1. An unauthenticated attacker can plant a crafted serialized object through the comment form, and the plugin's bundled Freemius library provides a gadget chain that can lead to code execution on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 05:46 UTC. All times on this page are UTC.
Sites running the Prime Mover plugin at version 2.2.1 or earlier are exposed, since the flaw is in the plugin's own migration code and bundled Freemius library and needs no other plugin or theme. The attack starts from the public comment form and triggers when an administrator runs an export or restore, so any public WordPress site with Prime Mover installed should be checked.
No product ranges from the sources yet.
prime-mover plugin header; versions up to and including 2.2.1 are affected.wp_comments.2.2.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
This page as .md · .json · in your agent: get_signal("CVE-2026-115806")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.