{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/prime-mover---backup-and-migration--2.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-115806"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-115806\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Prime Mover - Backup and Migration (\u003c= 2.2.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1. The vulnerability exists due to deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()).\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator performs a routine Prime Mover export or restore, the plugin decodes the stored value and passes it to unserialize() without class restrictions. The plugin contains a Property-Oriented Programming (POP) chain within its bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()).\u003c/p\u003e\n","date_modified":"2026-10-24T07:08:04Z","date_published":"2026-10-24T06:09:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-prime-mover-cve/","summary":"The Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 2.2.1.","title":"Prime Mover: Backup and Migration plugin PHP Object Injection (CVE-2026-115806)","url":"https://feed.craftedsignal.io/briefs/2026-10-prime-mover-cve/"}],"language":"en","title":"CraftedSignal Threat Feed - Prime Mover - Backup and Migration (\u003c= 2.2.1)","version":"https://jsonfeed.org/version/1.1"}