Published October 24, 2026. Based on public CVE records available on that date; details may change.

CVE-2026-115806 is a critical PHP Object Injection vulnerability in the Prime Mover (Backup and Migration) WordPress plugin, affecting all versions up to and including 2.2.1. An unauthenticated visitor can plant a payload in a comment, and it runs when an administrator later performs a Prime Mover export or restore. Update Prime Mover to 2.2.2, and do not run an export or restore on an older version until you have.

What happened

The CVE record, published by Wordfence on October 24, 2026, describes unsafe deserialization (CWE-502) in the plugin's migration search-and-replace routine, named in the record as recursiveUnserializeReplace(). The record's description makes three points:

  • An unauthenticated attacker can store a crafted, encoded payload in a comment submitted through the normal comment form.
  • When an administrator later runs a routine Prime Mover export or restore, the plugin decodes that stored value and passes it to PHP's unserialize() with no allowed_classes restriction.
  • A gadget chain (a POP chain) is present in the Freemius library that Prime Mover bundles, so no additional plugin or theme is required. The record says the chain ends in a call to update_option(), the WordPress function that writes site settings.

That last point matters. Many PHP Object Injection reports in WordPress plugins note that harm depends on a usable gadget chain in some other plugin or theme on the same site. This record says the opposite: the plugin ships the gadget itself.

The record's timeline lists the vendor as notified on October 11, 2026 and the issue as disclosed on October 22, 2026. The finder is credited as Civitasmass.

Severity and exploitation status

Wordfence, the CNA that issued the record, scores it CVSS 3.1 9.8 (critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD displays the same score with Wordfence as its source; at the time of writing NVD lists the record as received and has not published its own assessment.

The record does not mention exploitation in the wild, and it contains no proof-of-concept details. In practice, the attack has two steps: a comment goes in first, and nothing happens until someone with admin access runs an export or restore. That gives site owners a window to update before the plugin is used again.

Who is affected

Any site running Prime Mover 2.2.1 or earlier has the vulnerable code. The CVE record covers all versions up to and including 2.2.1 and lists everything else as unaffected, but it does not name a fixed version.

We determined the fix from the plugin's changelog on WordPress.org. The entry for 2.2.2 includes "Hardened unserialize implementation to prevent object injection," credited to Civitasmass and Wordfence, the same finder and CNA as the CVE record. It also lists an updated Freemius SDK. Version 2.2.2 is the current release on WordPress.org, last updated October 19, 2026. Prime Mover has 10,000+ active installations there.

Exposure is highest on sites that:

  • Accept comments from the public, including sites where comments go to moderation, since pending and spam comments are still stored in wp_comments. The record does not say whether comment status affects the attack.
  • Use Prime Mover regularly for backups, staging copies, or migrations, because each export or restore is a trigger point.

Backup and migration plugins deserve extra care in general. They read the whole database and package full site archives, so a flaw in that path touches everything the site holds, and the archives themselves contain user data and configuration that should stay private.

How to check your site

Start with the installed version.

  1. In the WordPress admin, open Plugins and find Prime Mover. Note the version number.
  2. With WP-CLI, run wp plugin get prime-mover --field=version from the WordPress directory.
  3. Run wp plugin list --name=prime-mover to see whether it is active.
  4. Repeat on staging and development copies, which are often created with a migration plugin and then forgotten.

If the version is 2.2.1 or lower, the site is affected. Check whether automatic updates are enabled for the plugin on the Plugins screen.

Then review comments. The record says the payload is a base64-encoded value placed in a comment's content. A comment whose body is mostly one long unbroken run of letters, digits, plus signs, slashes, and trailing equals signs, with no normal words, is worth a close look. Check every status, not just approved comments: open Comments and look at the Pending and Spam tabs too. With WP-CLI, wp comment list --status=hold --fields=comment_ID,comment_date,comment_author lists pending comments, and the same command with --status=spam or --status=approve covers the others. Use wp comment get <ID> --field=comment_content to read one in full.

If anyone ran a Prime Mover export or restore on an affected version recently, also review site settings, since the record says the chain ends by writing an option:

  • Under Settings > General, confirm the site address, the "Anyone can register" checkbox, and the new user default role are what you expect. With WP-CLI: wp option get siteurl, wp option get users_can_register, and wp option get default_role.
  • Check for administrator accounts nobody recognizes with wp user list --role=administrator. Our guide to finding hidden WordPress admin users covers this in more detail.

What to do now

The fix is to update Prime Mover to 2.2.2. Use Dashboard > Updates, the Plugins screen, or wp plugin update prime-mover. Do this before the next export, restore, or scheduled backup job that uses the plugin.

If you cannot update right away:

  • Do not run Prime Mover exports or restores until the update is in place.
  • Delete suspicious base64-looking comments from all statuses, including spam and trash, and consider closing comments under Settings > Discussion until you update.
  • If you do not use Prime Mover, deactivate it with wp plugin deactivate prime-mover and remove it once you have confirmed nothing depends on it.

After updating, delete any suspicious comments you found, and treat backup archives created on an affected version with some caution. They are still copies of your site's data, so store them somewhere that is not publicly reachable. The WordPress hardening checklist covers comment moderation, user registration, and plugin hygiene.

If the settings review turned up a changed site address, open registration you did not enable, or an unknown administrator, assume the site may be compromised and follow how to fix a hacked WordPress site.

When to get help

Get help if you find unexpected setting changes, admin accounts nobody created, or encoded comments after an export or restore ran on an affected version. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review your backup and migration setup alongside the rest of your plugins.

Sources