Threat database

The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.

CVE-2026-101890 is a stored cross-site scripting (XSS) vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows attackers to inject arbitrary JavaScript code via an unescaped site_title value in a package's footprint.json file. The malicious script executes in an administrator's browser when viewing the Prime Mover Packages list, without requiring package restoration.

CVE-2026-101889 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to delete arbitrary directories by importing a crafted package with manipulated configuration values. This can lead to deletion of critical WordPress directories such as wp-admin, potentially rendering the site inoperable.

CVE-2026-101888 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to write arbitrary files outside the intended extraction directory during ZIP import. This can lead to remote code execution if malicious files are processed by the web environment.