CVE-2026-115806: Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wpcomments.commentcontent through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowedclasses restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FSCloneManager::set → FSOptionManager::setoption → store() → updateoption()), so no additional plugin or theme is required — the plugin ships the gadget itself.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can submit a crafted base64-encoded serialized object through WordPress's standard comment-submission endpoint, where it is stored in comment_content. Exploitation does not require another plugin or theme because the required POP chain is bundled with Prime Mover.
When does the malicious comment get processed?
The stored payload is triggered when an administrator performs a Prime Mover export or restore that uses the migration search-and-replace routine. The routine base64-decodes the stored value and passes it to unserialize() without an allowed_classes restriction.
Are sites exposed without a special Prime Mover configuration?
The described attack uses the standard WordPress comment-submission endpoint and routine Prime Mover export or restore activity. No additional plugin or theme is required for the POP chain.
How can I assess whether an exploit attempt may be present?
Review wp_comments.comment_content for suspicious base64-encoded serialized-object payloads, particularly in comments submitted before a Prime Mover export or restore. The relevant stored input is comment content submitted through wp-comments-post.php.