{"id":"CVE-2026-115806","kind":"vulnerability","aliases":["CVE-2026-115806"],"related":[],"title":"WordPress Prime Mover plugin: unauthenticated PHP object injection via comments","description":"The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.","summary":"Prime Mover, a WordPress backup and migration plugin, unserializes attacker-supplied data stored in comment content during export or restore, for all versions up to and including 2.2.1. An unauthenticated attacker can plant a crafted serialized object through the comment form, and the plugin's bundled Freemius library provides a gadget chain that can lead to code execution on the site.","severity":"critical","cvss":9.8,"epss":0.00819,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","prime-mover","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-above-2.2.1"],"how_to_check":"- Check the installed Prime Mover plugin version in the WordPress admin plugins list or the `prime-mover` plugin header; versions up to and including `2.2.1` are affected.\n- unknown for whether comments containing base64-encoded serialized data already exist in `wp_comments`.","fix":"- Update the Prime Mover plugin to a version later than `2.2.1`; the sources do not name the fixed version.\n- Until updated, deactivate the Prime Mover plugin or restrict comment submission.","status":"open","published_at":"2026-10-24T05:17:04+00:00","first_seen_at":"2026-10-24T05:46:56+00:00","triaged_at":"2026-10-25T02:59:41+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T02:59:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Prime Mover plugin to a version later than `2.2.1`; the sources do not name the fixed version.\n- Until updated, deactivate the Prime Mover plugin or restrict comment submission.","reach":"internet","title":"WordPress Prime Mover plugin: unauthenticated PHP object injection via comments","impact":"high","summary":"Prime Mover, a WordPress backup and migration plugin, unserializes attacker-supplied data stored in comment content during export or restore, for all versions up to and including 2.2.1. An unauthenticated attacker can plant a crafted serialized object through the comment form, and the plugin's bundled Freemius library provides a gadget chain that can lead to code execution on the site.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","prime-mover","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the WordPress server via planted object","analyst_note":"Confirm the fixed Prime Mover version after 2.2.1 and whether a patch exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115806.","how_to_check":"- Check the installed Prime Mover plugin version in the WordPress admin plugins list or the `prime-mover` plugin header; versions up to and including `2.2.1` are affected.\n- unknown for whether comments containing base64-encoded serialized data already exist in `wp_comments`.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.2.1"],"who_is_affected":"Sites running the Prime Mover plugin at version 2.2.1 or earlier are exposed, since the flaw is in the plugin's own migration code and bundled Freemius library and needs no other plugin or theme. The attack starts from the public comment form and triggers when an administrator runs an export or restore, so any public WordPress site with Prime Mover installed should be checked.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":3537,"output_tokens":720,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115806':13A,16A '-2026':12A,15A '2.2.1':56B,112C 'addit':211C 'administr':152C 'allow':177C 'attack':38B,59B,129C 'attacker-suppli':37B 'backup':32B,93C 'base64':135C,165C 'base64-decodes':164C 'base64-encoded':134C 'bundl':74B,194C 'chain':80B,186C 'class':178C 'clone':198C 'code':85B 'comment':10A,43B,68B,146C 'comment-submiss':145C 'content':44B,141C 'craft':63B,133C 'cve':11A,14A 'data':40B 'decod':166C 'deseri':114C 'encod':136C 'endpoint':148C 'execut':86B 'export':46B,159C 'form':69B 'freemius':75B,195C 'fs':197C,201C 'gadget':79B,221C 'host':23B 'includ':55B,111C 'inject':8A,104C 'input':117C 'lead':83B 'librari':76B,196C 'manag':199C,203C 'migrat':34B,95C,120C 'mover':3A,20B,29B,92C,158C 'object':7A,65B,103C,138C 'option':202C,205C,208C 'orient':183C 'packag':17B 'pass':171C 'perform':154C 'php':6A,102C 'plant':61B 'plugin':4A,27B,35B,72B,96C,163C,191C,212C,218C 'pop':185C 'present':188C 'prime':2A,19B,28B,91C,157C 'prime-mov':18B 'program':184C 'properti':182C 'property-ori':181C 'provid':77B 'recursiveunserializereplac':126C 'replac':124C 'requir':216C 'restor':48B,161C 'restrict':179C 'routin':125C,156C 'search':122C 'search-and-replac':121C 'self':22B 'self-host':21B 'serial':64B,137C 'set':200C,204C 'ship':219C 'site':89B 'standard':144C 'store':41B,131C,168C,206C 'submiss':147C 'subsequ':153C 'suppli':39B 'theme':214C 'unauthent':5A,58B,128C 'unseri':36B,174C 'untrust':116C 'updat':207C 'valu':169C 'version':51B,107C 'via':9A,113C 'vulner':100C 'wordpress':1A,24B,26B,31B,98C 'wordpress-plugin':25B 'wp-comments-post.php':149C 'wp_comments.comment':140C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Prime Mover plugin at version 2.2.1 or earlier are exposed, since the flaw is in the plugin's own migration code and bundled Freemius library and needs no other plugin or theme. The attack starts from the public comment form and triggers when an administrator runs an export or restore, so any public WordPress site with Prime Mover installed should be checked.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T05:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115806","severity":null,"published_at":"2026-10-24T05:17:04+00:00","modified_at":"2026-10-24T05:17:04+00:00","first_seen_at":"2026-10-24T05:46:56+00:00","fetched_at":"2026-10-24T05:46:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115806","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115806","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}