CVE-2026-101888
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability…
- Risk score
- 53/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeEx…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.2.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.
Last activity 1 Oct 2026. Patch Forecast updates every hour.