CVE-2026-115806: Prime Mover WordPress Plugin – Unauthenticated Remote Code Execution via Object Injection
The Prime Mover backup and migration plugin for WordPress contains an unsafe deserialization flaw in its search-and-replace routine that accepts untrusted, base64-encoded serialized objects from comment fields. An attacker can inject a malicious object that exploits a Property-Oriented Pro
Prime Mover is a widely-used WordPress backup, restore, and site-migration plugin. Versions 2.2.1 and earlier deserialize untrusted data without restricting allowed classes in the recursiveUnserializeReplace() function. An attacker can submit a comment containing a base64-encoded malicious serialized object; when an admin later performs a routine export or restore, the plugin decodes and unserializes it, triggering a gadget chain in Freemius (bundled with Prime Mover) that leads to remote code execution.
| CVE | CVE-2026-115806 |
|---|---|
| Severity | Critical (CVSS 9.8) |
| Actively exploited | Not confirmed at time of writing |
| Weakness | CWE-502 (unsafe deserialization) |
| Attack vector | Network |
| Privileges required | None |
| User interaction | None |
| Published | 24 Oct 2026 |
How the attack works
An unauthenticated attacker crafts a PHP object that, when unserialized, invokes a Property-Oriented Programming chain: FS_Clone_Manager::__set triggers FS_Option_Manager::set_option, which calls store() and ultimately update_option(). The attacker base64-encodes this serialized payload and submits it via the standard WordPress comment form (wp-comments-post.php), storing it in wp_comments.comment_content. When an administrator later initiates a Prime Mover backup or restore, the plugin calls recursiveUnserializeReplace() on stored comments, base64-decodes the payload, and passes it to unserialize() with no restrictions. The gadget chain executes, allowing arbitrary code execution in the context of the WordPress process.
Who is affected
All versions of the Prime Mover – Backup and Migration plugin up to and including 2.2.1. Any WordPress site with this plugin installed is vulnerable to unauthenticated attack, regardless of user role or permissions, because comment submission is public by default.
How to check if you're exposed
- Query wp_comments table for entries with base64-like patterns or suspicious serialized object prefixes (O: or similar) in comment_content
- Check wp-config and plugin directory listings to confirm Prime Mover version; cross-reference against 2.2.1 or earlier
- Review access logs for POST requests to wp-comments-post.php from unusual sources or at unusual times, especially preceding admin backup/restore operations
- Inspect Prime Mover backup logs or database for signs of unexpected option updates or code execution during recent restore operations
How to fix it
- Upgrade Prime Mover to version 2.2.2 or later as soon as it is released and tested in your environment
- Until an upgrade is available, disable the Prime Mover plugin and use an alternative backup solution, or restrict comment submission to authenticated users only
- Audit wp_comments table and delete any suspicious or malicious comment entries; consider reviewing database for unexpected option_value changes in wp_options during the affected period
- Review administrator accounts and session logs for unauthorized activity correlating with backup/restore operations
If you can't patch yet
- Restrict comment submission to authenticated users only via WordPress settings (Settings > Discussion > Allow people to post comments)
- Disable or rate-limit the wp-comments-post.php endpoint at the web server or WAF level until the plugin is patched
- Monitor wp_options table changes and admin activity during backup/restore operations for anomalous behavior; consider a managed backup service separate from this plugin in the interim
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.