Prime Mover: Backup and Migration plugin PHP Object Injection (CVE-2026-115806)
The Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 2.2.1.
CVE search metadata
CVE search record: CVE-2026-115806. Severity: critical. CVSS: 9.8. KEV: no. Product: Prime Mover - Backup and Migration (<= 2.2.1). Brief: Prime Mover: Backup and Migration plugin PHP Object Injection (CVE-2026-115806). Brief link: https://feed.craftedsignal.io/briefs/2026-10-prime-mover-cve/
Triage facts
Revision 1- Applicability
- Prime Mover - Backup and Migration (<= 2.2.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 24, 06:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1. The vulnerability exists due to deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()).
An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator performs a routine Prime Mover export or restore, the plugin decodes the stored value and passes it to unserialize() without class restrictions. The plugin contains a Property-Oriented Programming (POP) chain within its bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()).