CVE-2026-115806: Unauthenticated PHP Object Injection in Prime Mover WordPress Plugin

"A critical (CVSS 9.8) PHP Object Injection flaw in the Prime Mover – Backup and Migration plugin for WordPress, through version 2.2.1, lets an unauthenticated attacker plant a malicious serialized object that fires when…"

A critical (CVSS 9.8) PHP Object Injection flaw in the Prime Mover – Backup and Migration plugin for WordPress, through version 2.2.1, lets an unauthenticated attacker plant a malicious serialized object that fires when an administrator runs a routine export or restore.

What Is It

CVE-2026-115806 is a deserialization of untrusted data vulnerability (CWE-502) in the plugin's migration search-and-replace routine, recursiveUnserializeReplace(). Wordfence reported it, and NVD published it on 2026-10-24.

The attack happens in two stages:

An unauthenticated attacker uses the standard WordPress comment endpoint (wp-comments-post.php) to submit a crafted, base64-encoded serialized object. The object is stored in wp_comments.comment_content.
Later, an administrator runs a normal Prime Mover export or restore. The plugin base64-decodes the stored value and passes it to unserialize() with no allowed_classes restriction.

The plugin ships its own gadget chain. The Freemius library bundled with it contains a Property-Oriented Programming (POP) chain: FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option(). No other plugin or theme is needed for exploitation.

Why It Matters

CVSS 3.1 base score: 9.8 (CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector scores the flaw as network-reachable and low complexity, with no privileges and no user interaction required (UI:N). In practice, the payload only fires after an administrator runs an export or restore, as described above.
Impact: high for confidentiality, integrity and availability.

Anyone who can post a comment can store the payload, so many sites expose the entry point by default. Exploitation then depends only on an administrator doing routine backup or migration work. Because the gadget chain ends in update_option(), the attacker can write WordPress options.

As of this writing, this CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation.

What's Vulnerable

Vendor: codexonics
Product: Prime Mover – Backup and Migration (WordPress plugin)
Affected versions: all versions up to and including 2.2.1

Patch Status

The supplied NVD record does not name a fixed version. NVD lists the record's status as "Received," meaning it has not yet been fully analyzed. CISA has issued no required action, because the CVE is not in KEV.

Until a fixed release is confirmed, administrators running Prime Mover 2.2.1 or earlier should:

Check the Wordfence advisory and the plugin's WordPress.org listing for an update.
Be cautious about running Prime Mover exports or restores on sites that accept public comments.

What Is It

Why It Matters

What's Vulnerable

Patch Status

Sources