CVE-2026-101888 in Prime Mover Plugin
Summary
by MITRE • 10/01/2026
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The Prime Mover plugin for WordPress prior to version 2.2.1 is affected by a critical Zip Slip path traversal vulnerability that compromises the integrity of file system operations during migration processes. This flaw resides within the utility functions responsible for handling ZIP archive extractions, specifically in the computeExtractionParameters and resumableZipExtractor methods located in utilities/PrimeMoverSystemCheckUtilities.php. The vulnerability arises from insufficient validation of entry names contained within uploaded ZIP files. When an administrator initiates a site migration by importing a backup or theme package, the plugin processes the internal file paths without adequately sanitizing directory traversal sequences such as ../. This lack of normalization allows crafted archive entries to reference locations outside the designated extraction root directory, effectively bypassing intended sandbox boundaries and enabling writes to arbitrary filesystem locations accessible by the web server process.
From an operational perspective, this vulnerability poses a severe risk because it requires only authenticated administrator privileges to exploit. While requiring authentication limits the attack surface compared to unauthenticated flaws, WordPress administrators often have broad system access that can be compromised through credential theft or session hijacking. An attacker who gains administrative control can construct a malicious ZIP archive containing files with paths like ../../wp-config.php or other sensitive configuration and script locations. Upon import, these files are written directly to the specified targets rather than being confined to the temporary migration directory. This capability fundamentally undermines the security model of the application by allowing an authenticated user to overwrite critical system files, modify existing scripts, or place new malicious payloads in directories where they will be executed by the web server interpreter such as PHP.
The potential impact extends beyond simple file manipulation and includes remote code execution (RCE). If the attacker writes a PHP script into a directory that is processed by the web server, such as the plugin root or theme folder, they can achieve full control over the underlying system. This aligns with Common Weakness Enumeration CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, and CWE-94, which covers Code Injection via improper neutralization of special elements in data inputs. The exploitation vector is classified under MITRE ATT&CK technique T1505.003, specifically Server Side Request Forgery (SSRF) related file inclusion or web shell deployment through upload mechanisms. In the context of WordPress ecosystems, this vulnerability can lead to complete site compromise, data exfiltration, and use as a pivot point for further attacks against internal networks hosting multiple sites.
Mitigation strategies must prioritize immediate patching by upgrading the Prime Mover plugin to version 2.2.1 or later, where the developers have implemented proper path normalization checks before extraction begins. Administrators should verify that no custom modifications override these security patches and ensure that file upload permissions are restricted according to the principle of least privilege. Additionally, implementing Web Application Firewall rules can help detect attempts to inject directory traversal sequences into uploaded archives. Regular auditing of plugin code for similar patterns in other utilities is recommended to prevent recurrence of path traversal flaws across the application suite. Monitoring server logs for unusual write operations outside expected directories provides an additional layer of defense against exploitation attempts that may bypass automated controls.