Securexion Daily Exploit Watch - 25 Oct 2026
PHP object injection in Prime Mover WordPress plugin allows unauthenticated attackers to execute code when admins perform routine backups; update immediately.
PHP object injection in Prime Mover WordPress plugin allows unauthenticated attackers to execute code when admins perform routine backups; update immediately.
Prime Mover WordPress Plugin – Unauthenticated Remote Code Execution via Object Injection
The Prime Mover backup and migration plugin for WordPress contains an unsafe deserialization flaw in its search-and-replace routine that accepts untrusted, base64-encoded serialized objects from comment fields. An attacker can inject a malicious object that exploits a Property-Oriented Programming chain in the bundled Freemius library to execute arbitrary code when an administrator runs a backup or restore operation.
What to do: Audit all Prime Mover installations and upgrade to version 2.2.2 or later immediately; if unavailable, disable the plugin until a patch is confirmed.
Securexion is the daily exploit watch by FutureOps InfoTech. Need help patching or checking for compromise? Talk to us.