CVE-2026-115806: CWE-502 Deserialization of Untrusted Data in codexonics Prime Mover – Backup and Migration

CVE-2026-115806 describes a critical PHP Object Injection vulnerability in the Prime Mover – Backup and Migration WordPress plugin up to version 2.2.1. The vulnerability arises from the plugin's migration search-and-replace routine (recursiveUnserializeReplace()) which unserializes base64-decoded data stored in wp_comments.comment_content without restricting allowed classes. An attacker can inject a malicious serialized object via the standard comment submission endpoint (wp-comments-post.php). When an administrator performs an export or restore, the plugin unserializes this data, triggering a Property-Oriented Programming (POP) chain in the plugin's bundled Freemius library, enabling remote code execution without requiring other plugins or themes.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the WordPress administrator performing the export or restore. This can lead to full site compromise, including data theft, site defacement, or further malware installation. The vulnerability has a CVSS 3.1 score of 9.8 (critical), reflecting its high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Administrators should avoid performing export or restore operations using the Prime Mover plugin until a vendor patch is released. Monitoring vendor advisories for an official fix is recommended. Restricting access to the comment submission endpoint or sanitizing comment content may reduce risk but do not fully mitigate the vulnerability.