> ## Content Index
> Fetch the complete content index at: https://securexion.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-115806: Prime Mover WordPress Plugin – Unauthenticated Remote Code Execution via Object Injection
- URL: https://securexion.com/cve-2026-115806/
- Published: 2026-10-26T06:53:56.000Z
- Updated: 2026-10-26T06:53:56.000Z
- Description: The Prime Mover backup and migration plugin for WordPress contains an unsafe deserialization flaw in its search-and-replace routine that accepts untrusted, base64-encoded serialized objects from comment fields. An attacker can inject a malicious object that exploits a Property-Oriented Pro
- Author: Securexion Team
- Tags: Vulnerability, Critical, #brief-2026-10-25

Prime Mover is a widely-used WordPress backup, restore, and site-migration plugin. Versions 2.2.1 and earlier deserialize untrusted data without restricting allowed classes in the recursiveUnserializeReplace() function. An attacker can submit a comment containing a base64-encoded malicious serialized object; when an admin later performs a routine export or restore, the plugin decodes and unserializes it, triggering a gadget chain in Freemius (bundled with Prime Mover) that leads to remote code execution.

| CVE                 | CVE-2026-115806                  |
| ------------------- | -------------------------------- |
| Severity            | Critical (CVSS 9.8)              |
| Actively exploited  | Not confirmed at time of writing |
| Weakness            | CWE-502 (unsafe deserialization) |
| Attack vector       | Network                          |
| Privileges required | None                             |
| User interaction    | None                             |
| Published           | 24 Oct 2026                      |

## How the attack works

An unauthenticated attacker crafts a PHP object that, when unserialized, invokes a Property-Oriented Programming chain: FS\_Clone\_Manager::\_\_set triggers FS\_Option\_Manager::set\_option, which calls store() and ultimately update\_option(). The attacker base64-encodes this serialized payload and submits it via the standard WordPress comment form (wp-comments-post.php), storing it in wp\_comments.comment\_content. When an administrator later initiates a Prime Mover backup or restore, the plugin calls recursiveUnserializeReplace() on stored comments, base64-decodes the payload, and passes it to unserialize() with no restrictions. The gadget chain executes, allowing arbitrary code execution in the context of the WordPress process.

## Who is affected

All versions of the Prime Mover – Backup and Migration plugin up to and including 2.2.1\. Any WordPress site with this plugin installed is vulnerable to unauthenticated attack, regardless of user role or permissions, because comment submission is public by default.

## How to check if you're exposed

- Query wp\_comments table for entries with base64-like patterns or suspicious serialized object prefixes (O: or similar) in comment\_content
- Check wp-config and plugin directory listings to confirm Prime Mover version; cross-reference against 2.2.1 or earlier
- Review access logs for POST requests to wp-comments-post.php from unusual sources or at unusual times, especially preceding admin backup/restore operations
- Inspect Prime Mover backup logs or database for signs of unexpected option updates or code execution during recent restore operations

## How to fix it

- Upgrade Prime Mover to version 2.2.2 or later as soon as it is released and tested in your environment
- Until an upgrade is available, disable the Prime Mover plugin and use an alternative backup solution, or restrict comment submission to authenticated users only
- Audit wp\_comments table and delete any suspicious or malicious comment entries; consider reviewing database for unexpected option\_value changes in wp\_options during the affected period
- Review administrator accounts and session logs for unauthorized activity correlating with backup/restore operations

## If you can't patch yet

- Restrict comment submission to authenticated users only via WordPress settings (Settings > Discussion > Allow people to post comments)
- Disable or rate-limit the wp-comments-post.php endpoint at the web server or WAF level until the plugin is patched
- Monitor wp\_options table changes and admin activity during backup/restore operations for anomalous behavior; consider a managed backup service separate from this plugin in the interim

---

*Need help checking your exposure or patching at scale?* [*FutureOps InfoTech*](https://futureopstech.com/?ref=securexion.com) *can help.*