Prime Mover through 2.2.1 – Unauthenticated PHP Object Injection (CVE-2026-115806)
Prime Mover – Backup and Migration versions 2.2.1 and earlier contain a critical unauthenticated PHP object injection vulnerability tracked as CVE-2026-115806. The issue is rated CVSS 9.8. Update to version 2.2.2 or later before running another export or restore.
| Product | Prime Mover – Backup and Migration |
|---|---|
| Affected versions | 2.2.1 and earlier |
| Fixed version | 2.2.2 |
| CVE | CVE-2026-115806 |
| Severity | Critical, CVSS 9.8 |
| Authentication | Not required |
| Attack class | PHP object injection / deserialization of untrusted data |
| Known exploitation | No confirmed in-the-wild exploitation at publication time; not listed in CISA KEV |
How the vulnerability works
Wordfence reports that an unauthenticated attacker can place attacker-controlled, encoded serialized data in a WordPress comment through the standard comment submission path. The value is stored in wp_comments.comment_content and may remain dormant until an administrator performs a Prime Mover export or restore.
During that migration workflow, the vulnerable recursiveUnserializeReplace() routine decodes the stored value and passes it to PHP unserialize() without restricting allowed classes. Prime Mover also bundles a usable property-oriented programming gadget chain in its Freemius library, so exploitation does not depend on a second vulnerable plugin or theme.
This creates a store-now, trigger-later risk: accepting a malicious comment is the initial step, while a later administrative backup or migration action can trigger deserialization. The administrator does not need to open the comment in wp-admin.
Immediate remediation
- Update Prime Mover to version 2.2.2 or later.
- Do not run Prime Mover exports or restores while version 2.2.1 or earlier is active.
- If an immediate update is impossible, deactivate the plugin and temporarily disable or strictly moderate new comments until the update is complete.
- Review comments submitted since the vulnerable version was installed, especially before resuming migration or restore operations.
- After updating, review administrator accounts, active plugins, scheduled tasks, and recently changed files for unexpected entries.
Version 2.2.2 is the vendor-confirmed security release. Its changelog states that the unserialize implementation was hardened to prevent object injection and that the bundled Freemius SDK was updated.
Verify and update with WP-CLI
wp plugin get prime-mover --fields=name,status,version,update,update_version
wp plugin update prime-mover
wp cache flushConfirm that the installed version is 2.2.2 or newer. If the plugin is not required, remove it after preserving any legitimate backup packages according to your recovery policy.
Defensive review
The following commands are read-only checks. They do not search for a weaponized payload; they help identify unexpected administrative changes after a potentially exposed migration workflow.
wp comment list --status=approve --fields=comment_ID,comment_date,comment_author,comment_author_url --format=table
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp plugin list --fields=name,status,version,update --format=table
wp cron event list --fields=hook,next_run_gmt,recurrence --format=table
wp core verify-checksumsAlso inspect web-server and application logs around Prime Mover export or restore events. Investigate unexpected administrator accounts, newly activated plugins, unknown scheduled hooks, modified PHP files, unusual option changes, or outbound connections. A clean review does not prove that exploitation did not occur; restore from a known-good backup and rotate secrets if compromise indicators are found.
Sources
