Prime Mover plugin: critical PHP Object Injection flaw

What it is and who is affectedThe National Vulnerability Database (NVD) of NIST has published CVE-2026-115806, a PHP Object Injection flaw (CWE-502) i...

What it is and who is affected

The National Vulnerability Database (NVD) of NIST has published CVE-2026-115806, a PHP Object Injection flaw (CWE-502) in The Prime Mover – Backup and Migration plugin for WordPress. The affected range is every version up to and including 2.2.1. The vulnerability was published on 24 October 2026 and carries a CVSS 3.1 score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network reachable, no privileges and no user interaction required.

The mechanism matters because it is unusually convenient for an attacker. The plugin's migration search-and-replace routine, through its recursive unserialisation helper, decodes values stored in the comments table. An unauthenticated visitor can therefore leave a crafted, base64-encoded serialised object in a normal blog comment. Later, when an administrator runs a routine Prime Mover export or restore, the plugin decodes that stored value and passes it to PHP's unserialise function without restricting the classes it will instantiate. Because the plugin bundles its own Freemius library, and that library contains a usable Property-Oriented Programming chain, no extra plugin or theme is needed: the gadget ships inside Prime Mover itself.

In practical terms, any Spanish SME, online shop or small IT team running a WordPress site with this plugin installed is exposed, whether or not comments are actively moderated. Sites that accept comments from the public are the most direct target.

Why it is urgent — and what is not yet known

To be precise: CVE-2026-115806 does not currently appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public confirmation that it is being exploited in the wild, and no CISA remediation deadline applies. That is not a reason to relax. A 9.8 critical rating with an unauthenticated entry point and a ready-made gadget chain is exactly the profile that gets weaponised quickly once proof-of-concept details circulate, and the trigger is a routine administrative action that most site owners perform without a second thought.

The exposure is also quiet. A malicious comment looks like an ordinary comment; nothing breaks until an export or restore runs, and by then the payload has already executed with the privileges of the WordPress installation.

What to do today

Check whether the plugin is installed and which version you run. Look in the WordPress plugin list for Prime Mover. If it is present at 2.2.1 or below, you are in the affected range. If it is not installed at all, there is nothing to fix here.
Apply the fix indicated in the vendor's advisory. The NVD entry does not state a corrected version, so do not guess: follow the official Prime Mover advisory and update to whatever release it designates. If no update is available yet, consider deactivating the plugin until one is, and remove it entirely if you no longer use it.
Review for signs of intrusion. Inspect the comments table for unusual base64-looking content, check administrator accounts and recent option changes, and look at logs around any export or restore performed since the site was last updated.
Reduce what is exposed to the internet. If comment submission is not essential, restrict or disable it. Put the WordPress admin behind access controls, keep backups offline, and apply the same patch discipline to every other plugin and theme — this class of flaw is rarely unique to one component.

How a cybersecurity team such as ALMC can help

Situations like this are where a small IT team benefits from an extra pair of hands. ALMC's cybersecurity work for businesses starts with a security audit and pentesting to find the vulnerabilities that are actually reachable on your installation, followed by hardening of servers and the CMS itself. For WordPress, PrestaShop and Joomla sites we handle maintenance and security patching so that critical advisories do not sit unattended for weeks, and we set up monitoring and incident response so that suspicious activity is caught before it turns into a restore gone wrong. If a site has already been compromised, we also repair hacked websites and close the entry point that was used. All of this is delivered from Lleida and across Catalonia — Barcelona, Tarragona, Girona and beyond — with GDPR-compliant handling of your data throughout.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.