The Prime Mover plugin for WordPress versions prior to 2.2.1 contains a Zip Slip path traversal vulnerability. Authenticated administrators can exploit this by crafting ZIP entry names with traversal sequences that are processed by the computeExtractionParameters() and resumableZipExtractor() functions in utilities/PrimeMoverSystemCheckUtilities.php. This allows writing arbitrary files to locations outside the intended extraction directory, potentially enabling remote code execution if the files are executed by the web server.

Successful exploitation allows an authenticated administrator to write arbitrary files outside the intended directory during ZIP import. This can lead to remote code execution if the attacker-controlled files are interpreted by the web environment, posing a high security risk.

A fixed version 2.2.1 or later should be applied to remediate this vulnerability. Since the affected versions are prior to 2.2.1, upgrading to 2.2.1 or newer will mitigate the issue. No vendor advisory content was provided, so patch status is inferred from the versioning information.