CVE-2026-101888: Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress administrator is required to import a crafted migration ZIP. The issue is therefore most relevant where administrator accounts may be compromised, shared, or available to less-trusted users.
Are default installations affected?
The provided information identifies Prime Mover versions before 2.2.1 as affected. Exploitation requires use of the migration ZIP import functionality; no separate non-default configuration requirement is stated.
What is the likely impact of a successful exploit?
A successful attacker can write attacker-controlled files outside the intended ZIP extraction directory. This may result in remote code execution if the target filesystem location is web-accessible and the written file is interpreted by the web environment.
How can I determine whether my site is affected?
Check whether the Prime Mover plugin version is earlier than 2.2.1 and whether administrator accounts can access migration ZIP import. Review import activity and relevant filesystem locations for unexpected files created through migration imports.