CVE-2026-115806 in Prime Mover Plugin
Summary
by MITRE • 10/24/2026
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The Prime Mover – Backup and Migration plugin for WordPress, specifically in versions up to and including 2.2.1, contains a critical PHP Object Injection vulnerability that allows unauthenticated attackers to achieve remote code execution on affected sites. This flaw stems from the improper handling of serialized data within the migration search-and-replace routine, which utilizes a function named recursiveUnserializeReplace(). The core issue lies in the fact that this function accepts user-controlled input and passes it directly to PHP's unserialize() function without enforcing any restrictions on allowed classes or validating the integrity of the incoming payload. This lack of validation creates a direct pathway for attackers to inject malicious serialized objects into the application environment, exploiting the inherent dangers associated with deserializing untrusted data in PHP applications.
The attack vector is particularly insidious because it leverages standard WordPress functionality that does not require authentication. An attacker can store a crafted, base64-encoded serialized object within the wp_comments.comment_content field by submitting a comment through the public-facing endpoint at wp-comments-post.php. This method effectively bypasses many traditional security controls since commenting is often enabled for all users on WordPress sites. Once this malicious payload is stored in the database, it remains dormant until an administrator performs a routine operation that triggers the vulnerable code path. Specifically, when an admin initiates a Prime Mover export or restore process, the plugin retrieves the comment content, base64-decodes the value, and subsequently passes it to unserialize(). Because there are no allowed_classes restrictions applied during this deserialization step, any class present in the serialized payload can be instantiated, provided its methods exist within the loaded PHP environment.
The severity of this vulnerability is significantly amplified by the presence of a Property-Oriented Programming (POP) chain located directly within the plugin's bundled dependencies. The Prime Mover plugin includes the Freemius library, which contains a specific gadget chain involving the classes FS_Clone_Manager and FS_Option_Manager. When an attacker injects their payload, they can trigger the __set magic method in FS_Clone_Manager, which subsequently calls set_option on FS_Option_Manager. This action leads to a call to store(), which ultimately invokes WordPress's update_option() function. Through this chain, attackers can manipulate plugin options and potentially execute arbitrary code by leveraging side effects or specific configurations within these classes. Crucially, because the necessary gadgets are bundled with the plugin itself, an attacker does not need to rely on other installed plugins or themes that might contain compatible deserialization vulnerabilities, making exploitation more reliable and accessible.
From a classification perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data, as well as CWE-470 regarding the use of externally-controlled input in object instantiation logic. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise, this technique falls under T1059, specifically Command and Scripting Interpreter subcategories like PHP scripting (T1059.008), where attackers utilize built-in language features to execute commands. The ability to achieve remote code execution through a comment field also relates to CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component, although the primary mechanism here is object injection rather than simple command injection via string concatenation.
The operational impact of this vulnerability is severe, as it grants unauthenticated attackers full control over the compromised WordPress installation. Once code execution is achieved, an attacker can read sensitive files such as wp-config.php to extract database credentials and API keys, modify site content, install backdoors for persistent access, or pivot further into internal networks if the server has broader connectivity. The fact that exploitation requires only a single comment submission makes this vulnerability highly scalable for automated attacks targeting large numbers of WordPress sites running vulnerable versions of Prime Mover.
To mitigate this risk, administrators must immediately update the Prime Mover – Backup and Migration plugin to version 2.2.2 or later, where the deserialization logic has been hardened with appropriate class whitelisting or input validation checks. Until an upgrade is possible, site owners should consider disabling comments on their WordPress sites if they are not actively used for community engagement, thereby removing the primary attack vector. Additionally, implementing a Web Application Firewall (WAF) rule that detects and blocks requests containing suspicious serialized data patterns in comment submissions can provide temporary protection against exploitation attempts. Regular security audits and monitoring of server logs for unusual activity related to deserialization events or unexpected file modifications are also recommended to detect any potential compromise early.