Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115806— Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

Quick assessment

Affected
codexonics Prime Mover – Backup and Migration
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"Prime Mover – Backup and Migration"插件在所有 2.2.1 及更早版本中，均存在 PHP 对象注入漏洞。该漏洞源于其迁移搜索与替换流程（recursiveUnserializeReplace()）中对不可信输入的反序列化操作。未认证的攻击者可通过标准的评论提交接口（wp-comments-post.php），将精心构造的、经 Base64 编码的序列化对象存储于 wp_comments 表的 comment_content 字段中。当管理员随后执行常规的 P

CVSS 9.8 · Critical EPSS 0.82% · P57
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115806

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Source: CVE Program / CVE List V5
Vulnerability Description
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
codexonics Prime Mover – Backup and Migration 0 ~ 2.2.1 -

II. Public POCs for CVE-2026-115806

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115806

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115806 (1)

IV. Related Vulnerabilities

Same vendor: codexonics
Same weakness: CWE-502

V. Comments for CVE-2026-115806

No comments yet

Leave a comment