CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection…

Risk score: 85/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.8%
Published: 24 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The Prime Mover plugin for WordPress has a PHP Object Injection vulnerability in all versions up to 2.2.1, allowing an attacker to inject malicious code via deserialization of untrusted input. An attacker can exploit this vulnerability without authentication, leading to high impact.
Affected: {'products': ['WordPress'], 'packages': ['Prime Mover plugin'], 'versions': ['all versions up to and including 2.2.1']}
Fix: Check the linked advisory for a fix, but as a mitigation, do not use the Prime Mover plugin until it is updated.
Exploitation: No known exploitation

Why it is Red

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: php

References

Original description

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.

Last activity 24 Oct 2026. Patch Forecast updates every hour.