IT SBIT Services
Schneeberger
DEEN
CVE tracker

Prime Mover Backup and Migration: PHP Object Injection via comments

CVE-2026-115806Critical 9.8

← All vulnerabilities

Summary

The Prime Mover – Backup and Migration WordPress plugin up to and including 2.2.1 deserializes untrusted data during its migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object through the public comment form. When an administrator later runs an export or restore, the plugin unserializes it, and a gadget chain in the bundled Freemius library can be used to execute code or manipulate data on the server (CVSS 9.8).

Affected

  • Prime Mover – Backup and Migration plugin for WordPress, all versions up to and including 2.2.1
  • Default configuration: unaffected (per CNA record, affected range is 0 to 2.2.1)

Fixed in

  • Version 2.2.2 or later
  • The vendor changelog for 2.2.2 mentions a hardened unserialize implementation and an updated Freemius SDK. It does not name the CVE.

Workaround

  • No vendor-published workaround.
  • Until the plugin is updated: deactivate it, avoid running export or restore jobs, and review recent comments for unusual base64-like content.

Exploitation

  • Not listed in CISA KEV; EPSS below 1 percent.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.
  • No public proof of concept or confirmed in-the-wild exploitation found.
  • A Nuclei detection template PR exists; it is a detection tool, not an exploit.

Our recommendation

  • Check all WordPress sites for Prime Mover – Backup and Migration.
  • Update to version 2.2.2 or later.
  • If the plugin ran on an internet-facing site, review comments and admin logs for suspicious activity.
  • Limit or moderate comments on sites where they are not needed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:40.

Original description (NVD)

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed